Question 1

What does a Nest Guard do?

Accepted Answer

Implements canActivate to allow/deny access before the route handler runs — typically authn/authz. Return boolean/Promise/Observable. Throw Unauthorized/Forbidden for clear HTTP semantics. Read metadata via Reflector.

Question 2

How do you build role-based guards with custom decorators?

Accepted Answer

Set metadata with SetMetadata; Reflector reads roles in the guard; compare to user claims. Compose @Roles('admin') on handlers. Keep role checks out of controllers. Prefer central policy when complexity grows.

Question 3

Guard order and multiple guards — behavior?

Accepted Answer

All must allow (AND). Execution order follows registration (global → controller → method). Design fail-fast cheap checks first. Don't put heavy DB in every guard without caching.

Question 4

Guards vs middleware for API keys?

Accepted Answer

Either works; guards better access to ExecutionContext and route metadata; middleware earlier for very coarse rejection. For Nest purity and OpenAPI/metadata, guards win. Document the choice.

Question 5

Scenario: public health route blocked by global AuthGuard.

Accepted Answer

Use @Public() metadata and guard short-circuit when public; or exclude routes carefully. Global guards need escape hatches. Test public routes in e2e.

Question 6

Lead: authorization model beyond role strings in Nest?

Accepted Answer

Move to policy/ability engines (CASL), resource-based checks in domain services, and thin guards that invoke policies. Roles don't scale for multi-tenant resource ownership. Keep decision logic testable outside HTTP.

Guards NestJS Interview Questions

Other NestJS interview topics