NestJS NestJS Authentication & Security 2

Question 1

What is Role-Based Access Control (RBAC) in the context of NestJS guards?

Accepted Answer

A pattern where guards check user roles stored in metadata to allow or deny access

Answer

RBAC in NestJS is implemented by attaching role metadata via custom decorators and checking it inside a guard using Reflector.

Question 2

What does the `@SetMetadata()` decorator do in NestJS?

Accepted Answer

Attaches custom key-value metadata to a route handler or controller

Answer

@SetMetadata() stores arbitrary metadata on a route or controller that can later be retrieved by guards or interceptors using Reflector.

Question 3

Which class do NestJS guards need to implement?

Accepted Answer

CanActivate

Answer

Guards must implement the CanActivate interface, which requires a canActivate() method that returns a boolean or Observable<boolean>.

Question 4

In NestJS, what is the Reflector class used for inside a guard?

Accepted Answer

Retrieving metadata attached to route handlers via decorators

Answer

Reflector.get() or getAllAndOverride() reads the custom metadata set by @SetMetadata() or custom decorators on route handlers.

Question 5

What is the execution order of NestJS request lifecycle components?

Accepted Answer

Middleware → Guards → Interceptors → Pipes → Controllers

Answer

The NestJS request pipeline executes in this order: Middleware → Guards → Interceptors (before) → Pipes → Controller → Interceptors (after) → Exception Filters.

NestJS Practice Test

NestJS Practice Test

NestJS NestJS Authentication & Security 2