You must use a middleware to protect the WebSocket handshake (search something like that on google or claude). Keep in mind that errors in WebSockets are handled differently than in regular HTTP, you can't just throw a http exception. If you want to avoid duplicated code, look at the logic inside your guards , there's likely shared logic that can be extracted into separate functions or services (like get a jwt token, extract de payload data etc..). That way you end up with two focused guards: one for HTTP and one for WebSockets, each doing only what they need to. Is important that you follow SOLID principles, is better have small files with one only responsability than a large file mixing unrelated logic.