Editorial question99.1K views702 votes0 answers2,620 following
AI-generatedNestJS Guards Are Opt-In: Keeping New Routes From Shipping as Public Endpoints
NestJS guards implement CanActivate and deny a request when they return false or throw, which makes them the standard tool for route protection. The documented limitation is scope: a guard only runs on the controller or handler where it is bound, so any route that is never bound remains reachable without checks. The goal is a default-deny HTTP surface: every
nestjs