Global middleware in NestJS

Introduction

Global middleware runs for every request in your app. It helps you add common features like logging or security checks everywhere without repeating code.

You want to log every request to your server.

You need to check user authentication on all routes.

You want to add headers to all responses.

You want to measure how long each request takes.

You want to handle CORS or security policies globally.

Syntax

NestJS

import { Injectable, NestMiddleware, MiddlewareConsumer, Module, NestModule } from '@nestjs/common';
import { Request, Response, NextFunction } from 'express';

@Injectable()
export class LoggerMiddleware implements NestMiddleware {
  use(req: Request, res: Response, next: NextFunction) {
    console.log(`Request... Method: ${req.method}, URL: ${req.url}`);
    next();
  }
}

@Module({})
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer.apply(LoggerMiddleware).forRoutes('*');
  }
}

The forRoutes('*') means the middleware runs on all routes.

Middleware must call next() to continue the request cycle.

Examples

This applies the middleware to every route in the app.

NestJS

consumer.apply(LoggerMiddleware).forRoutes('*');

This applies the middleware only to the /users route.

NestJS

consumer.apply(AuthMiddleware).forRoutes('users');

This applies multiple middleware globally in order.

NestJS

consumer.apply(LoggerMiddleware, AuthMiddleware).forRoutes('*');

Sample Program

This example shows how to create a simple logger middleware that prints the HTTP method and URL for every request. It is applied globally to all routes using forRoutes('*').

NestJS

import { Injectable, NestMiddleware, MiddlewareConsumer, Module, NestModule } from '@nestjs/common';
import { Request, Response, NextFunction } from 'express';

@Injectable()
export class LoggerMiddleware implements NestMiddleware {
  use(req: Request, res: Response, next: NextFunction) {
    console.log(`Request... Method: ${req.method}, URL: ${req.url}`);
    next();
  }
}

@Module({})
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer.apply(LoggerMiddleware).forRoutes('*');
  }
}

// When you run the NestJS app and make any HTTP request, the console will show the request method and URL.

Important Notes

Global middleware runs before route handlers and can modify requests or responses.

Always call next() in middleware to avoid blocking requests.

You can apply multiple middleware globally by listing them in apply().

Summary

Global middleware runs on every request in the app.

Use consumer.apply(...).forRoutes('*') to apply middleware globally.

Middleware helps add common features like logging or security checks easily.

Practice

1. What is the main purpose of global middleware in a NestJS application?

easy

A. To define database models for the application

B. To run code on every incoming request before reaching route handlers

C. To create new routes dynamically

D. To handle errors after the response is sent

Solution

1. Step 1: Understand middleware role

   Middleware runs before route handlers to process requests or add features like logging.

2. Step 2: Identify global middleware scope

   Global middleware runs on every request, so it applies common logic everywhere.

3. Final Answer:

   To run code on every incoming request before reaching route handlers -> Option B

4. Quick Check:

   Global middleware = runs on every request [OK]

Hint: Global middleware runs before routes on all requests [OK]

Common Mistakes:

• Confusing middleware with route handlers
• Thinking middleware only runs on some routes
• Mixing middleware with error handling

2. Which of the following is the correct way to apply a middleware globally in NestJS?

easy

A. app.useGlobalMiddleware(MyMiddleware)

B. consumer.apply(MyMiddleware).forRoutes('users')

C. consumer.apply(MyMiddleware).forRoutes('*')

D. app.applyMiddlewareGlobally(MyMiddleware)

Solution

1. Step 1: Recall global middleware syntax

   In NestJS, the recommended way to apply middleware globally is using app.useGlobalMiddleware(MyMiddleware).

2. Step 2: Compare options

   consumer.apply(MyMiddleware).forRoutes('*') applies middleware to all routes but is not truly global middleware; app.useGlobalMiddleware applies middleware globally.

3. Final Answer:

   app.useGlobalMiddleware(MyMiddleware) -> Option A

4. Quick Check:

   Global middleware uses app.useGlobalMiddleware [OK]

Hint: Use app.useGlobalMiddleware to apply middleware globally [OK]

Common Mistakes:

• Using consumer.apply(...).forRoutes('*') for global middleware
• Trying to call non-existent app methods
• Confusing middleware registration with guards

3. Given this middleware code, what will be logged for every request?

export class LoggerMiddleware implements NestMiddleware {
  use(req: Request, res: Response, next: Function) {
    console.log(`Request to: ${req.url}`);
    next();
  }
}

// Applied globally with consumer.apply(LoggerMiddleware).forRoutes('*')

medium

A. Logs the HTTP method only

B. Logs the response status code

C. Logs nothing because next() is missing

D. Logs the URL of every incoming request

Solution

1. Step 1: Analyze middleware code

   The middleware logs the string 'Request to:' plus the request URL from req.url.

2. Step 2: Understand global application

   Since applied globally, this log happens on every request URL received by the app.

3. Final Answer:

   Logs the URL of every incoming request -> Option D

4. Quick Check:

   LoggerMiddleware logs req.url every request [OK]

Hint: Look for console.log inside middleware use() method [OK]

Common Mistakes:

• Assuming HTTP method is logged instead of URL
• Forgetting next() causes no further processing
• Thinking response status is logged

4. Identify the error in this global middleware setup:

export class AuthMiddleware implements NestMiddleware {
  use(req: Request, res: Response) {
    if (!req.headers.authorization) {
      res.status(401).send('Unauthorized');
    }
  }
}

// Applied with consumer.apply(AuthMiddleware).forRoutes('*')

medium

A. Missing call to next() to continue request processing

B. Middleware should not check headers

C. forRoutes('*') cannot be used for global middleware

D. res.status(401) is invalid syntax

Solution

1. Step 1: Check middleware method signature

   The use method lacks the next parameter and does not call next(), so request stops here.

2. Step 2: Understand middleware flow

   Without calling next(), the request will hang or not proceed to route handlers after middleware.

3. Final Answer:

   Missing call to next() to continue request processing -> Option A

4. Quick Check:

   Middleware must call next() to proceed [OK]

Hint: Always call next() in middleware to continue [OK]

Common Mistakes:

• Omitting next() call in middleware
• Misunderstanding middleware flow control
• Thinking forRoutes('*') is invalid

5. You want to apply a logging middleware globally but only for HTTP POST requests. Which approach correctly achieves this in NestJS?

hard

A. Use consumer.apply(LoggerMiddleware).forRoutes('*') and check req.method inside middleware

B. Apply middleware only on POST routes manually, no global option

C. Use consumer.apply(LoggerMiddleware).forRoutes({ path: '*', method: RequestMethod.POST })

D. Use app.useGlobalMiddleware(LoggerMiddleware) with method filter

Solution

1. Step 1: Understand route filtering in middleware

   NestJS allows filtering middleware by path and HTTP method using forRoutes with an object.

2. Step 2: Apply middleware globally but only for POST

   Using forRoutes({ path: '*', method: RequestMethod.POST }) applies middleware to all paths but only POST requests.

3. Step 3: Evaluate other options

   Use consumer.apply(LoggerMiddleware).forRoutes('*') and check req.method inside middleware applies middleware on all methods, not just POST. Apply middleware only on POST routes manually, no global option is manual, not global. Use app.useGlobalMiddleware(LoggerMiddleware) with method filter is invalid syntax.

4. Final Answer:

   Use consumer.apply(LoggerMiddleware).forRoutes({ path: '*', method: RequestMethod.POST }) -> Option C

5. Quick Check:

   forRoutes with method filter = selective global middleware [OK]

Hint: Use forRoutes({ path: '*', method: RequestMethod.POST }) for selective global [OK]

Common Mistakes:

• Applying middleware globally without method filter
• Trying non-existent app.useGlobalMiddleware method
• Manually applying middleware on each POST route