{"id":"1c5aba537681ce4d","repo":"nestjs/nest","slug":"forbidden-resource-1c5aba","errorCode":null,"errorMessage":"Forbidden resource","messagePattern":"Forbidden resource","errorType":"exception","errorClass":"WsException","httpStatus":null,"severity":"error","filePath":"packages/websockets/context/ws-context-creator.ts","lineNumber":158,"sourceCode":"    return Reflect.getMetadata(MESSAGE_METADATA, callback);\n  }\n\n  public createGuardsFn<TContext extends string = ContextType>(\n    guards: any[],\n    instance: Controller,\n    callback: (...args: unknown[]) => any,\n    contextType?: TContext,\n  ): Function | null {\n    const canActivateFn = async (args: any[]) => {\n      const canActivate = await this.guardsConsumer.tryActivate<TContext>(\n        guards,\n        args,\n        instance,\n        callback,\n        contextType,\n      );\n      if (!canActivate) {\n        throw new WsException(FORBIDDEN_MESSAGE);\n      }\n    };\n    return guards.length ? canActivateFn : null;\n  }\n\n  public getMetadata<TMetadata, TContext extends ContextType = ContextType>(\n    instance: Controller,\n    methodName: string,\n    contextType: TContext,\n  ): WsHandlerMetadata {\n    const cacheMetadata = this.handlerMetadataStorage.get(instance, methodName);\n    if (cacheMetadata) {\n      return cacheMetadata;\n    }\n    const metadata =\n      this.contextUtils.reflectCallbackMetadata<TMetadata>(\n        instance,\n        methodName,","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/nestjs/nest/blob/6ec0e2783d15290732447f304d8549b591b9749e/packages/websockets/context/ws-context-creator.ts#L140-L176","documentation":"Error \"Forbidden resource\" thrown in nestjs/nest.","triggerScenarios":"Thrown at packages/websockets/context/ws-context-creator.ts:158 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Make the WebSocket guard return true (or throw a more specific WsException) for allowed clients; a false return yields 'Forbidden resource'.","Fix authentication/authorization logic inside the @WebSocketGateway guard (e.g. validate the token from the handshake).","Ensure the guard's canActivate returns a boolean or WsException instead of throwing HTTP exceptions."],"exampleFix":"canActivate(context: ExecutionContext): boolean {\n  const client = context.switchToWs().getClient();\n  return this.auth.validate(client.handshake.auth?.token);\n}","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"analyzedSha":"6ec0e2783d15290732447f304d8549b591b9749e","analyzedAt":"2026-08-03T17:42:23.673Z","schemaVersion":2}