A guard's canActivate() returns false. What does the client receive by default?

When a guard returns false, Nest throws a ForbiddenException. The client gets a 403 Forbidden.

"401 Unauthorized" is wrong for the default case. To return 401, the guard must throw UnauthorizedException itself. JWT guards usually do this.