NestJS · Senior · Question 25 of 75

What's a risk of putting authorization logic only in guards?

✓Correct answer: Guards often don't have the loaded resource, so object-level checks get skipped; services must also enforce ownership
2Guards can't throw exceptions
3Guards run after the handler

Explanation

Combine route-level guards (who may call this?) with checks in the domain layer (may this user touch this object?).

Further reading

Test yourself

Take the NestJS · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.