Why guards control access in NestJS - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary role of a guard in NestJS?

In NestJS, guards are used to control access to routes or controllers. What is the main purpose of a guard?

A To manage database connections for each request

B To transform the response data before sending it to the client

C To handle exceptions and send error responses

D To determine if a request should be allowed to proceed based on custom logic

💡 Hint

Think about what controls whether a user can enter a route or not.

Guards in NestJS decide if a request can continue to the route handler by returning true or false. They are mainly used for authorization and access control.

❓ component_behavior

intermediate

What happens when a guard returns false?

Consider a NestJS guard that returns false during a request. What is the effect on the request processing?

A The request is denied and a 403 Forbidden response is sent

B The request proceeds to the next middleware or handler

C The request is redirected to the login page automatically

D The server crashes with an error

💡 Hint

Think about what happens when access is denied.

If a guard returns false, NestJS stops processing the request and sends a 403 Forbidden response by default.

📝 Syntax

advanced

Identify the correct guard implementation syntax

Which of the following code snippets correctly implements a NestJS guard that allows access only if the user role is 'admin'?

NestJS

import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';

@Injectable()
export class AdminGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const user = request.user;
    // Check user role
    return ???;
  }
}

A return user?.role === 'admin';

B return user.role = 'admin';

C return user.role == 'admin';

D return user.role === admin;

💡 Hint

Use strict equality and optional chaining to avoid errors if user is undefined.

Option A uses optional chaining to safely access user.role and strict equality to compare with 'admin'.

Option A uses assignment (=) instead of comparison (===), which is wrong.

Option A uses loose equality (==), which is less safe.

Option A misses quotes around 'admin', causing a ReferenceError.

❓ state_output

advanced

What is the output when a guard throws an exception?

Given this guard code snippet, what will be the HTTP response status code if the guard throws a ForbiddenException? import { CanActivate, ExecutionContext, Injectable, ForbiddenException } from '@nestjs/common'; @Injectable() export class SampleGuard implements CanActivate { canActivate(context: ExecutionContext): boolean { throw new ForbiddenException('Access denied'); } }

A 500 Internal Server Error

B 401 Unauthorized with message 'Access denied'

C 403 Forbidden with message 'Access denied'

D 200 OK with empty response

💡 Hint

ForbiddenException corresponds to which HTTP status code?

Throwing ForbiddenException causes NestJS to send a 403 Forbidden response with the provided message.

🔧 Debug

expert

Why does this guard block even admin access?

Review the following guard code. Why does it fail to allow access for users with the 'admin' role? import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common'; @Injectable() export class FaultyGuard implements CanActivate { canActivate(context: ExecutionContext): boolean { const request = context.switchToHttp().getRequest(); const user = request.user; if (user.role === 'admin') { true; } return false; } }

A The user object is undefined, causing a runtime error

B The guard always returns false because the if block does not return true explicitly

C The guard returns true for all users because of missing else statement

D The guard throws an exception instead of returning a boolean

💡 Hint

Check if the if block returns a value properly.

The if block contains 'true;' but does not return it. So the function always returns false, blocking all access.

Practice

1. What is the main purpose of guards in a NestJS application?

easy

A. To format the response data before sending it to the client

B. To control access by allowing or blocking requests based on conditions

C. To manage database connections and queries

D. To handle errors and exceptions globally

Solution

1. Step 1: Understand the role of guards

   Guards are designed to check conditions before a route handler runs, deciding if access should be granted.

2. Step 2: Compare with other responsibilities

   Formatting responses, managing database, and error handling are done by other parts of NestJS, not guards.

3. Final Answer:

   To control access by allowing or blocking requests based on conditions -> Option B

4. Quick Check:

   Guards control access = A [OK]

Hint: Guards decide if a request can proceed or not [OK]

Common Mistakes:

• Confusing guards with interceptors or filters
• Thinking guards handle data formatting
• Assuming guards manage database logic

2. Which of the following is the correct way to apply a guard to a controller method in NestJS?

easy

A. @UseGuards(AuthGuard) before the method declaration

B. @Guard(AuthGuard) inside the method body

C. UseGuards(AuthGuard) as a function call in the constructor

D. Apply guard logic directly inside the controller constructor

Solution

1. Step 1: Recall NestJS guard syntax

   Guards are applied using the @UseGuards() decorator placed before the method or class.

2. Step 2: Evaluate options

   Only @UseGuards(AuthGuard) before the method declaration uses the correct decorator syntax before the method. Others misuse syntax or placement.

3. Final Answer:

   @UseGuards(AuthGuard) before the method declaration -> Option A

4. Quick Check:

   @UseGuards decorator = A [OK]

Hint: Use @UseGuards decorator above methods or classes [OK]

Common Mistakes:

• Using @Guard instead of @UseGuards
• Calling UseGuards as a function inside constructor
• Placing guard logic inside constructor instead of decorator

3. Given this guard code snippet:

canActivate(context: ExecutionContext) {
  const request = context.switchToHttp().getRequest();
  return request.user && request.user.isAdmin;
}

What will happen if a user without isAdmin tries to access the guarded route?

medium

A. Access will be granted because the guard always returns true

B. The guard will ignore the user and allow access

C. An error will be thrown due to missing isAdmin property

D. Access will be denied because isAdmin is false or missing

Solution

1. Step 1: Analyze the guard condition

   The guard returns true only if request.user exists and request.user.isAdmin is truthy.

2. Step 2: Consider user without isAdmin

   If isAdmin is false or missing, the condition returns false, denying access.

3. Final Answer:

   Access will be denied because isAdmin is false or missing -> Option D

4. Quick Check:

   Guard returns false if not admin = B [OK]

Hint: Guard returns true only if user is admin [OK]

Common Mistakes:

• Assuming missing property causes error
• Thinking guard always returns true
• Ignoring the boolean check on isAdmin

4. Identify the error in this guard implementation:

canActivate(context: ExecutionContext) {
  const request = context.getRequest();
  if (!request.user) {
    throw new Error('User not found');
  }
  return true;
}

medium

A. Throwing an error inside a guard instead of returning false

B. Missing async keyword for canActivate method

C. Using context.getRequest() instead of context.switchToHttp().getRequest()

D. Returning true without checking user roles

Solution

1. Step 1: Check method usage for request

   While context.getRequest() is invalid, the main issue is guard behavior on failure.

2. Step 2: Understand guard error handling

   Guards should return false to deny access, not throw errors which cause server crashes.

3. Final Answer:

   Throwing an error inside a guard instead of returning false -> Option A

4. Quick Check:

   Guards return false, not throw errors [OK]

Hint: Return false to block access, don't throw errors in guards [OK]

Common Mistakes:

• Throwing errors instead of returning false
• Using incorrect context method for request
• Assuming async is required without async code

5. You want to restrict access to a route only to logged-in users with the role 'admin' or 'moderator'. Which guard logic correctly implements this?

hard

A. Return true if request.user does not exist

B. Return true if request.user exists and request.user.role === 'admin' && request.user.role === 'moderator'

C. Return true if request.user exists and request.user.role === 'admin' || request.user.role === 'moderator'

D. Return true if request.user exists and request.user.role !== 'admin' || request.user.role !== 'moderator'

Solution

1. Step 1: Understand role conditions

   The user must be logged in and have role 'admin' OR 'moderator' to access.

2. Step 2: Evaluate logical operators

   Return true if request.user exists and request.user.role === 'admin' || request.user.role === 'moderator' uses OR (||) correctly. Return true if request.user exists and request.user.role === 'admin' && request.user.role === 'moderator' uses AND (&&) which is impossible for one role. Return true if request.user exists and request.user.role !== 'admin' || request.user.role !== 'moderator' uses negations incorrectly. Return true if request.user does not exist allows access without user.

3. Final Answer:

   Return true if request.user exists and request.user.role === 'admin' || request.user.role === 'moderator' -> Option C

4. Quick Check:

   Use OR for multiple allowed roles = D [OK]

Hint: Use OR (||) to allow multiple roles [OK]

Common Mistakes:

• Using AND (&&) instead of OR (||) for roles
• Allowing access when user is missing
• Incorrect negation logic in conditions