NestJS · Middle · Question 2 of 75

Why should authentication be a guard rather than middleware?

1Middleware can't read headers
✓Correct answer: Guards have the ExecutionContext, so they know which handler and metadata (roles, @Public()) apply, and they work across HTTP, GraphQL and microservices
3Middleware runs after the handler

Explanation

Middleware doesn't know which route handler will run. Guards are designed for 'may this request proceed?' decisions.

Further reading

Test yourself

Take the NestJS · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.