CodePark/ questions / Guards & auth
START PRACTICINGPRACTICE
Backend question · NestJS › Guards & auth

A guard is registered with app.useGlobalGuards(new RolesGuard(new Reflector())), and also on a controller with @UseGuards(AuthGuard). In which order do they run, and what limitation does the global one have?

Global first, then controller; the global one is created outside any module, so Nest can't inject its dependencies

Guards run global first, then controller-level, then method-level. The global guard here is created with new inside useGlobalGuards(). So it lives outside the DI container (the part of Nest that creates objects and injects their dependencies). You must pass its dependencies by hand. Registering it as APP_GUARD in a module fixes this.

The other limits in the options are wrong. "the global one cannot read metadata" is false: global guards can read metadata through Reflector. "the global one cannot be async" is also false: global guards can be async.