nestjs/nest · error · WsException

Forbidden resource

Error message

Forbidden resource

What it means

Error "Forbidden resource" thrown in nestjs/nest.

Source

Thrown at packages/websockets/context/ws-context-creator.ts:158

    return Reflect.getMetadata(MESSAGE_METADATA, callback);
  }

  public createGuardsFn<TContext extends string = ContextType>(
    guards: any[],
    instance: Controller,
    callback: (...args: unknown[]) => any,
    contextType?: TContext,
  ): Function | null {
    const canActivateFn = async (args: any[]) => {
      const canActivate = await this.guardsConsumer.tryActivate<TContext>(
        guards,
        args,
        instance,
        callback,
        contextType,
      );
      if (!canActivate) {
        throw new WsException(FORBIDDEN_MESSAGE);
      }
    };
    return guards.length ? canActivateFn : null;
  }

  public getMetadata<TMetadata, TContext extends ContextType = ContextType>(
    instance: Controller,
    methodName: string,
    contextType: TContext,
  ): WsHandlerMetadata {
    const cacheMetadata = this.handlerMetadataStorage.get(instance, methodName);
    if (cacheMetadata) {
      return cacheMetadata;
    }
    const metadata =
      this.contextUtils.reflectCallbackMetadata<TMetadata>(
        instance,
        methodName,

View on GitHub (pinned to 6ec0e2783d)

Solutions

1. Make the WebSocket guard return true (or throw a more specific WsException) for allowed clients; a false return yields 'Forbidden resource'.
2. Fix authentication/authorization logic inside the @WebSocketGateway guard (e.g. validate the token from the handshake).
3. Ensure the guard's canActivate returns a boolean or WsException instead of throwing HTTP exceptions.

Example fix

canActivate(context: ExecutionContext): boolean {
  const client = context.switchToWs().getClient();
  return this.auth.validate(client.handshake.auth?.token);
}

When it happens

Trigger: Thrown at packages/websockets/context/ws-context-creator.ts:158 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nestjs/nest@6ec0e2783d (2026-08-03). Data as JSON: /data/errors/1c5aba537681ce4d.json. Report an issue: GitHub.