Why Applying middleware to routes in NestJS? - Purpose & Use Cases

The Big Idea

What if you could add a security check to all your routes with just one line of code?

The Scenario

Imagine you have many routes in your app, and you want to check if a user is logged in before they can access certain pages. You try to add this check inside every route handler manually.

The Problem

Manually adding the same check to every route is tiring, easy to forget, and makes your code messy. If you want to change the check, you must update every route separately, which wastes time and causes bugs.

The Solution

Applying middleware to routes lets you write the check once and attach it to many routes automatically. This keeps your code clean and makes updates simple because the middleware runs before the route handlers.

Before vs After

✗ Before

app.get('/profile', (req, res) => { if (!req.user) return res.status(401).send('Login required'); /* handle profile */ });

✓ After

app.use('/profile', authMiddleware); app.get('/profile', (req, res) => { /* handle profile */ });

What It Enables

You can easily add shared logic like authentication, logging, or error handling to many routes without repeating code.

Real Life Example

A website requires users to log in before accessing their dashboard and settings pages. Middleware checks login status once and protects all these routes automatically.

Key Takeaways

Manual checks in every route are repetitive and error-prone.

Middleware runs shared code before routes, keeping code clean.

Applying middleware to routes makes maintenance and updates easier.

Practice

1. What is the main purpose of applying middleware to routes in a NestJS application?

easy

A. To run code before the route handler processes the request

B. To directly send responses without reaching the route handler

C. To replace the route handler with a new function

D. To automatically generate API documentation

Solution

1. Step 1: Understand middleware role

   Middleware runs before the route handler to process or modify requests.

2. Step 2: Identify middleware effect on routes

   It does not replace handlers or generate docs but can log or check requests first.

3. Final Answer:

   To run code before the route handler processes the request -> Option A

4. Quick Check:

   Middleware runs before route handlers [OK]

Hint: Middleware always runs before route handlers [OK]

Common Mistakes:

• Thinking middleware replaces route handlers
• Confusing middleware with response sending
• Assuming middleware auto-generates docs

2. Which of the following is the correct syntax to apply a middleware named LoggerMiddleware to all routes in a NestJS module?

easy

A. consumer.use(LoggerMiddleware).forRoutes('/');

B. consumer.apply(LoggerMiddleware).forRoutes('/');

C. consumer.apply(LoggerMiddleware).forRoutes('*');

D. consumer.apply(LoggerMiddleware).toRoutes('*');

Solution

1. Step 1: Recall NestJS middleware syntax

   The correct method to apply middleware is consumer.apply(...).forRoutes(...).

2. Step 2: Identify correct route pattern for all routes

   Using '/' applies middleware to all routes; '*' is invalid.

3. Final Answer:

   consumer.apply(LoggerMiddleware).forRoutes('/'); -> Option B

4. Quick Check:

   Use apply + forRoutes('/') for all routes [OK]

Hint: Use apply() with forRoutes('/') to cover all routes [OK]

Common Mistakes:

• Using use() instead of apply()
• Using toRoutes() which is invalid
• Using '*' instead of '/' for all routes

3. Given this middleware application code in a NestJS module:

consumer.apply(AuthMiddleware).forRoutes('users');

Which routes will have the AuthMiddleware applied?

medium

A. All routes including '/users' and '/users/:id'

B. Only routes with path exactly '/users'

C. All routes in the application

D. No routes, because the path is invalid

Solution

1. Step 1: Understand forRoutes string behavior

   Passing 'users' applies middleware to all routes starting with '/users', including parameters.

2. Step 2: Confirm middleware coverage

   This includes '/users', '/users/123', '/users/profile', etc., not the entire app.

3. Final Answer:

   All routes including '/users' and '/users/:id' -> Option A

4. Quick Check:

   forRoutes('users') covers prefix routes [OK]

Hint: forRoutes('path') applies middleware to that path and subpaths [OK]

Common Mistakes:

• Thinking only exact path matches get middleware
• Assuming middleware applies globally without '*'
• Believing invalid path disables middleware

4. Examine this NestJS middleware setup:

export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer.apply(AuthMiddleware).forRoutes();
  }
}

What is the issue with this code?

medium

A. Middleware class must be decorated with @Injectable

B. Middleware is applied globally without specifying routes

C. Missing route argument in forRoutes causes a runtime error

D. MiddlewareConsumer is not imported correctly

Solution

1. Step 1: Check forRoutes usage

   The method forRoutes requires at least one argument specifying routes; empty call is invalid.

2. Step 2: Identify error type

   Calling forRoutes() without arguments causes a runtime error because no routes are defined.

3. Final Answer:

   Missing route argument in forRoutes causes a runtime error -> Option C

4. Quick Check:

   forRoutes() needs routes argument [OK]

Hint: Always provide routes to forRoutes() [OK]

Common Mistakes:

• Leaving forRoutes empty
• Assuming middleware applies globally without routes
• Ignoring missing @Injectable on middleware

5. You want to apply LoggerMiddleware only to POST requests on the /orders route in NestJS. Which approach correctly applies middleware only to POST /orders requests?

hard

A. Apply middleware globally and skip non-POST requests inside middleware

B. Use consumer.apply(LoggerMiddleware).forRoutes('orders'); and check method inside middleware

C. Use consumer.apply(LoggerMiddleware).forRoutes('orders'); without method filtering

D. Use consumer.apply(LoggerMiddleware).forRoutes({ path: 'orders', method: RequestMethod.POST });

Solution

1. Step 1: Understand method filtering in middleware

   NestJS allows specifying method with an object: { path, method } in forRoutes.

2. Step 2: Identify correct syntax for POST-only middleware

   Using consumer.apply(...).forRoutes({ path: 'orders', method: RequestMethod.POST }) applies middleware only to POST /orders.

3. Final Answer:

   Use consumer.apply(LoggerMiddleware).forRoutes({ path: 'orders', method: RequestMethod.POST }); -> Option D

4. Quick Check:

   Use object with path and method in forRoutes for method filtering [OK]

Hint: Use forRoutes({path, method}) to target HTTP methods [OK]

Common Mistakes:

• Applying middleware to all methods without filtering
• Checking method inside middleware instead of in forRoutes
• Applying middleware globally and filtering inside middleware