NestJS has gained immense popularity for its robust framework designed for developing efficient, scalable, and maintainable server-side applications. One of the core concepts that enhances a NestJS application's security and access control is the use of Guards. In this article, we'll delve into what Guards are, how to implement custom guards, and their essential role in securing your NestJS applications.

What are Guards?

In NestJS, Guards are classes that implement the CanActivate interface. They are used to determine whether a particular request should be processed by a route handler or not, effectively acting as a gatekeeper. This makes them essential for performing authentication and authorization checks in your application.

Key Points:

• Guards can check if a user is authenticated.
• They can determine if a user has the necessary permissions for a specific route.
• Guards can be applied globally, at the route handler level, or at the controller level.

Setting Up Your NestJS Project

Before we dive into creating guards, ensure you have a basic NestJS project set up. If you haven't created one yet, you can easily do this using the NestJS CLI:

npm i -g @nestjs/cli
nest new nest-js-guards-demo
cd nest-js-guards-demo
npm install @nestjs/passport passport passport-jwt

This sets up a new NestJS project and installs the necessary packages for authentication.

Creating a Simple Guard

Let's create a simple guard to handle authentication. We'll use the AuthGuard provided by Passport.

Step 1: Create Auth Guard

Create a new file called auth.guard.ts in the src directory:

import { Injectable } from '@nestjs/common';
import { AuthGuard as PassportAuthGuard } from '@nestjs/passport';

@Injectable()
export class AuthGuard extends PassportAuthGuard('jwt') {}

In this example, we are extending the AuthGuard from @nestjs/passport for JWT authentication.

Step 2: Applying the Guard

Now that we have our guard ready, we can apply it to a controller. Open or create a controller (e.g., app.controller.ts), and add the guard to a route:

import { Controller, Get, UseGuards } from '@nestjs/common';
import { AuthGuard } from './auth.guard';

@Controller('protected')
export class AppController {
  @UseGuards(AuthGuard)
  @Get()
  getProtectedResource() {
    return { message: 'This is a protected resource' };
  }
}

Here, any request to /protected will first pass through the AuthGuard. If the authentication fails (e.g., invalid token), the request will be rejected.

Creating Custom Guards

NestJS also allows you to create custom guards tailored to specific use cases. Let’s implement a role-based access guard.

Step 3: Define Role-Based Guard

Create a file named roles.guard.ts:

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';

@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private readonly requiredRoles: string[]) {}

  canActivate(context: ExecutionContext): boolean {
    const req = context.switchToHttp().getRequest();
    const user = req.user;

    // Check if user has the required roles
    return user && this.requiredRoles.some(role => user.roles.includes(role));
  }
}

Step 4: Apply the Custom Guard

To use this guard, we can modify our controller:

import { Controller, Get, UseGuards } from '@nestjs/common';
import { AuthGuard } from './auth.guard';
import { RolesGuard } from './roles.guard';

@Controller('admin')
export class AdminController {
  @UseGuards(AuthGuard, new RolesGuard(['admin']))
  @Get()
  getAdminResource() {
    return { message: 'This is an admin-only resource' };
  }
}

With this setup, only users with an admin role can access the /admin endpoint.

Conclusion

Guards in NestJS serve as a vital layer for managing access, enhancing authorization checks, and promoting security across your applications. By understanding how to implement both built-in and custom guards, you can effectively tailor your application's security model to meet your specific requirements.

As you grow your NestJS skills, mastering the nuances of Guards will empower you to build reliable and secure backend services. Dive deeper into this feature and other powerful capabilities of NestJS to elevate your backend development experience!