Applying middleware to routes in NestJS

Introduction

Middleware helps you run code before your route handles a request. It can check or change requests easily.

You want to log every request to certain routes.

You need to check if a user is logged in before accessing a page.

You want to add headers or modify requests for specific routes.

You want to block requests from certain IP addresses on some routes.

Syntax

NestJS

import { Injectable, NestMiddleware } from '@nestjs/common';
import { Request, Response, NextFunction } from 'express';

@Injectable()
export class MyMiddleware implements NestMiddleware {
  use(req: Request, res: Response, next: NextFunction) {
    // your code here
    next();
  }
}

// In your module
import { MiddlewareConsumer, Module, RequestMethod } from '@nestjs/common';

@Module({
  providers: [MyMiddleware]
})
export class AppModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply(MyMiddleware)
      .forRoutes('route-path');
  }
}

Middleware class must implement NestMiddleware and have a use method.

Use consumer.apply(...).forRoutes(...) to attach middleware to routes.

Examples

This applies LoggerMiddleware to all requests to the /cats route.

NestJS

consumer.apply(LoggerMiddleware).forRoutes('cats');

This applies AuthMiddleware only to GET requests on /dogs.

NestJS

consumer.apply(AuthMiddleware).forRoutes({ path: 'dogs', method: RequestMethod.GET });

This applies two middleware in order to the /users route.

NestJS

consumer.apply(LoggerMiddleware, AuthMiddleware).forRoutes('users');

This applies middleware to all routes and methods.

NestJS

consumer.apply(MyMiddleware).forRoutes({ path: '*', method: RequestMethod.ALL });

Sample Program

This example creates a simple logger middleware that prints the HTTP method and URL for GET requests to /hello. It shows how to apply middleware to a specific route and method.

NestJS

import { Injectable, NestMiddleware, MiddlewareConsumer, Module, RequestMethod } from '@nestjs/common';
import { Request, Response, NextFunction } from 'express';

@Injectable()
export class LoggerMiddleware implements NestMiddleware {
  use(req: Request, res: Response, next: NextFunction) {
    console.log(`Request to: ${req.method} ${req.url}`);
    next();
  }
}

@Module({
  providers: [LoggerMiddleware]
})
export class AppModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply(LoggerMiddleware)
      .forRoutes({ path: 'hello', method: RequestMethod.GET });
  }
}

// Assume a controller with GET /hello route exists

Important Notes

Always call next() in middleware to continue the request cycle.

You can apply middleware to multiple routes or methods by passing arrays.

Middleware runs before route handlers, so it can block or modify requests early.

Summary

Middleware runs code before routes handle requests.

Use consumer.apply(...).forRoutes(...) to attach middleware to routes.

Middleware can log, check, or change requests easily.

Practice

1. What is the main purpose of applying middleware to routes in a NestJS application?

easy

A. To run code before the route handler processes the request

B. To directly send responses without reaching the route handler

C. To replace the route handler with a new function

D. To automatically generate API documentation

Solution

1. Step 1: Understand middleware role

   Middleware runs before the route handler to process or modify requests.

2. Step 2: Identify middleware effect on routes

   It does not replace handlers or generate docs but can log or check requests first.

3. Final Answer:

   To run code before the route handler processes the request -> Option A

4. Quick Check:

   Middleware runs before route handlers [OK]

Hint: Middleware always runs before route handlers [OK]

Common Mistakes:

• Thinking middleware replaces route handlers
• Confusing middleware with response sending
• Assuming middleware auto-generates docs

2. Which of the following is the correct syntax to apply a middleware named LoggerMiddleware to all routes in a NestJS module?

easy

A. consumer.use(LoggerMiddleware).forRoutes('/');

B. consumer.apply(LoggerMiddleware).forRoutes('/');

C. consumer.apply(LoggerMiddleware).forRoutes('*');

D. consumer.apply(LoggerMiddleware).toRoutes('*');

Solution

1. Step 1: Recall NestJS middleware syntax

   The correct method to apply middleware is consumer.apply(...).forRoutes(...).

2. Step 2: Identify correct route pattern for all routes

   Using '/' applies middleware to all routes; '*' is invalid.

3. Final Answer:

   consumer.apply(LoggerMiddleware).forRoutes('/'); -> Option B

4. Quick Check:

   Use apply + forRoutes('/') for all routes [OK]

Hint: Use apply() with forRoutes('/') to cover all routes [OK]

Common Mistakes:

• Using use() instead of apply()
• Using toRoutes() which is invalid
• Using '*' instead of '/' for all routes

3. Given this middleware application code in a NestJS module:

consumer.apply(AuthMiddleware).forRoutes('users');

Which routes will have the AuthMiddleware applied?

medium

A. All routes including '/users' and '/users/:id'

B. Only routes with path exactly '/users'

C. All routes in the application

D. No routes, because the path is invalid

Solution

1. Step 1: Understand forRoutes string behavior

   Passing 'users' applies middleware to all routes starting with '/users', including parameters.

2. Step 2: Confirm middleware coverage

   This includes '/users', '/users/123', '/users/profile', etc., not the entire app.

3. Final Answer:

   All routes including '/users' and '/users/:id' -> Option A

4. Quick Check:

   forRoutes('users') covers prefix routes [OK]

Hint: forRoutes('path') applies middleware to that path and subpaths [OK]

Common Mistakes:

• Thinking only exact path matches get middleware
• Assuming middleware applies globally without '*'
• Believing invalid path disables middleware

4. Examine this NestJS middleware setup:

export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer.apply(AuthMiddleware).forRoutes();
  }
}

What is the issue with this code?

medium

A. Middleware class must be decorated with @Injectable

B. Middleware is applied globally without specifying routes

C. Missing route argument in forRoutes causes a runtime error

D. MiddlewareConsumer is not imported correctly

Solution

1. Step 1: Check forRoutes usage

   The method forRoutes requires at least one argument specifying routes; empty call is invalid.

2. Step 2: Identify error type

   Calling forRoutes() without arguments causes a runtime error because no routes are defined.

3. Final Answer:

   Missing route argument in forRoutes causes a runtime error -> Option C

4. Quick Check:

   forRoutes() needs routes argument [OK]

Hint: Always provide routes to forRoutes() [OK]

Common Mistakes:

• Leaving forRoutes empty
• Assuming middleware applies globally without routes
• Ignoring missing @Injectable on middleware

5. You want to apply LoggerMiddleware only to POST requests on the /orders route in NestJS. Which approach correctly applies middleware only to POST /orders requests?

hard

A. Apply middleware globally and skip non-POST requests inside middleware

B. Use consumer.apply(LoggerMiddleware).forRoutes('orders'); and check method inside middleware

C. Use consumer.apply(LoggerMiddleware).forRoutes('orders'); without method filtering

D. Use consumer.apply(LoggerMiddleware).forRoutes({ path: 'orders', method: RequestMethod.POST });

Solution

1. Step 1: Understand method filtering in middleware

   NestJS allows specifying method with an object: { path, method } in forRoutes.

2. Step 2: Identify correct syntax for POST-only middleware

   Using consumer.apply(...).forRoutes({ path: 'orders', method: RequestMethod.POST }) applies middleware only to POST /orders.

3. Final Answer:

   Use consumer.apply(LoggerMiddleware).forRoutes({ path: 'orders', method: RequestMethod.POST }); -> Option D

4. Quick Check:

   Use object with path and method in forRoutes for method filtering [OK]

Hint: Use forRoutes({path, method}) to target HTTP methods [OK]

Common Mistakes:

• Applying middleware to all methods without filtering
• Checking method inside middleware instead of in forRoutes
• Applying middleware globally and filtering inside middleware