Topic
Definition
Nest processes an incoming request through ordered extension points — middleware, guards, interceptors, and pipes — where each stage has full access to different information and a distinct, narrow responsibility.
In simpler words
Middleware runs first and knows nothing about routes; guards decide who may proceed; pipes clean up and validate the data the handler will receive.
Correlation ids, JWT/role checks, and DTO validation look similar — “code that runs before my controller” — but belong in different stages for a reason.
Definition
Middleware executes before Nest resolves a route handler and its metadata, guards execute afterward with full execution-context access, and pipes execute per parameter to transform or validate arguments just before the handler runs.
In simpler words
Middleware cannot see @Roles or @Public; guards can. Pipes see one argument at a time, not the whole request.
Rough order: Middleware → Guards → Interceptors (before) → Pipes → Controller handler → Interceptors (after) → Exception filters.
CorrelationIdMiddleware runs for every matched path via consumer.apply(...).forRoutes("*") — it cannot make an authorization decision because guards, and the route metadata they read, do not exist yet at that point.
const correlationId = req.header('x-correlation-id') ?? randomUUID();
req.correlationId = correlationId;
res.setHeader('x-correlation-id', correlationId);
next();Cross-cutting and stateless — a good middleware job. It never reads @Roles or user identity.
Definition
A new cross-cutting request concern belongs in middleware only when it needs no route metadata and no per-argument transformation, in a guard when it depends on route metadata or the authenticated subject, and in a pipe when it validates or reshapes one specific argument.
In simpler words
Ask: does this need the route’s decorators (guard), just one incoming value (pipe), or neither (middleware)?
ValidationPipe is registered globally in main.ts and runs for every DTO-typed parameter — it is what turns CreateTicketDto’s decorators into an actual 400 response.
ParseUUIDPipe on :id params is a pipe too: it rejects a malformed id before TicketsService ever runs a query.
GET /tickets/not-a-uuid
// Middleware: attaches correlation id, calls next()
// Guards: JwtAuthGuard confirms the session, RolesGuard allows (no @Roles here)
// Pipe: ParseUUIDPipe rejects 'not-a-uuid' -> 400 before the handler runsEach stage rejects or passes the request for a different reason — none of them duplicate the others’ job.
Test
At least 10 questions — mix of concept, syntax, practical, and logic. Score ≥ 80% (enforced by the API) to save progress.
Checking your session…
10 questions · concept 3 · syntax 2 · practical 3 · logic 2