# Authorization & RBAC (Node.js / NestJS)

> Role-based access control, custom guards, decorators, permissions, resource ownership

- 20 interview questions
- Mid-Level
- [Interview Questions: Node.js / NestJS](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions.md)

## 1. What is RBAC (Role-Based Access Control)?

**Answer**

RBAC is an access control system that grants permissions to users based on their roles. Instead of managing permissions individually for each user, RBAC groups permissions into roles (e.g., ADMIN, USER, MANAGER) and assigns these roles to users. This simplifies access management in applications, particularly useful in NestJS with custom guards and metadata decorators.

## 2. What is the difference between authentication and authorization?

**Answer**

Authentication verifies the user's identity (who are you?), typically via login/password or JWT token. Authorization verifies the user's permissions (what can you do?), controlling access to resources based on roles or permissions. In NestJS, authentication often uses JwtAuthGuard, while authorization uses custom guards like RolesGuard to check access rights.

## 3. Which NestJS decorator allows creating a custom guard?

**Answer**

To create a custom guard in NestJS, create a class decorated with @Injectable() that implements the CanActivate interface. This interface requires the canActivate(context: ExecutionContext) method that returns a boolean or Promise. The guard can then be applied to routes with @UseGuards(). This architecture allows injecting dependencies (services, repositories) into the guard to perform complex validations.

## 17 more questions available

- In RBAC, what does a 'permission' represent?
- How to attach a guard to a controller in NestJS?

Sign up for free: https://sharpskill.dev/en/login

## Other Node.js / NestJS interview topics

- [Node.js Fundamentals](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/nodejs-fundamentals.md): 20 questions, Junior
- [Node.js Core APIs](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/nodejs-core-apis.md): 25 questions, Junior
- [Asynchronous Programming](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/asynchronous-programming.md): 25 questions, Junior
- [Express.js Basics](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/express-basics.md): 20 questions, Junior
- [NestJS Fundamentals](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/nestjs-fundamentals.md): 23 questions, Junior
- [REST API Design](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/rest-api-design.md): 20 questions, Junior
- [Validation & DTO](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/validation-dto.md): 20 questions, Junior
- [API Documentation & Contracts](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/api-documentation.md): 20 questions, Junior
- [Error Handling](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/error-handling.md): 20 questions, Junior
- [Unit Testing](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/testing-unit.md): 20 questions, Junior
- [Task Scheduling](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/scheduling-cron.md): 15 questions, Junior
- [NestJS Modules & DI](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/nestjs-modules-di.md): 20 questions, Mid-Level
- [Configuration & Environment Management](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/configuration-environment.md): 20 questions, Mid-Level
- [JWT Authentication](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/authentication-jwt.md): 25 questions, Mid-Level
- [Database with TypeORM](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/database-typeorm.md): 30 questions, Mid-Level
- [Prisma ORM](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/prisma-orm.md): 25 questions, Mid-Level
- [Middleware & Interceptors](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/middleware-interceptors.md): 20 questions, Mid-Level
- [File Upload](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/file-upload.md): 15 questions, Mid-Level
- [WebSockets](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/websockets.md): 20 questions, Mid-Level
- [GraphQL with NestJS](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/graphql-basics.md): 25 questions, Mid-Level
- [End-to-End Testing](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/testing-e2e.md): 20 questions, Mid-Level
- [Caching with Redis](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/caching-redis.md): 20 questions, Mid-Level
- [Queues with Bull](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/queues-bull.md): 20 questions, Mid-Level
- [DevOps, Logging & CI/CD](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/logging-monitoring.md): 25 questions, Mid-Level
- [Docker & Containerization](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/docker-containerization.md): 25 questions, Mid-Level
- [Microservices](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/microservices.md): 30 questions, Senior
- [Security Best Practices](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/security-best-practices.md): 25 questions, Senior
- [Performance & Cloud Deployment](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/performance-optimization.md): 30 questions, Senior

---

Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack.
HTML version of this page: https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/authorization-rbac