Topic

Postman + VS Code debugging

Definition

API testing tools such as Postman let you construct and replay HTTP requests independent of the frontend, while an interactive debugger attaches to a running process to pause execution and inspect state at a breakpoint.

In simpler words

Postman lets you talk to Nest directly without the React app in the way. A debugger lets you freeze Nest mid-request and look at its variables.

These are everyday tools for isolating whether a bug is frontend, backend, or a contract mismatch, before touching any code.

Open official example (opens in new tab)

After this you can

Reproduce a bug with a request tool before assuming it is a frontend bug
Save and reuse a collection with cookie-based auth
Set a breakpoint in a Nest handler and step through it
Read a stack trace back to the failing line and layer

Isolate the layer before you guess

Definition

Isolating a bug means removing variables, such as frontend rendering, browser caching, and network conditions, until only the suspected layer remains, so a request tool that talks directly to Nest can confirm whether the API itself is at fault.

In simpler words

Ask whether the bug also happens outside the browser before spending an hour in React code.

If a Postman request reproduces the bug with the same status and body the frontend saw, the problem is in Nest or the data, not React state management.

If Postman succeeds but the browser fails, suspect CORS, cookie or credentials settings, a stale query cache, or a request built with the wrong payload shape.

Save requests with the exact cookie and auth flow, running a login request first with cookie saving enabled, so protected routes are reproducible without touching the UI.

Repro checklist

1. Log in via Postman (stores access_token cookie in the collection)
2. Replay the failing request with that cookie
3. Compare status and body to what the browser received
4. If identical, it is a backend or data bug. If different, it is a client-side bug.

A five-minute Postman check saves hours of guessing which layer is wrong.

Debugging Nest with VS Code

Definition

A breakpoint pauses process execution at a specified line, allowing inspection of the call stack and local variables, and stepping through subsequent lines one at a time.

In simpler words

A breakpoint freezes Nest at one line so every variable can be inspected at that exact moment.

Launch Nest in debug mode, or attach to the running development process, and set a breakpoint inside the suspected controller, service, or guard.

Step Into descends into the next function call, Step Over runs the current line without descending, and Step Out returns to the caller. Use these to walk the exact pipeline order across guards, pipes, controllers, and services.

Inspect the call stack to see which middleware, guard, or interceptor actually ran before the failure, rather than guessing from the error message alone.

Minimal attach configuration

{
  "type": "node",
  "request": "attach",
  "port": 9229,
  "restart": true
}

Attaching to a process started with an inspect flag allows setting breakpoints without restarting Nest for every change.

Reading a stack trace

Definition

A stack trace lists the sequence of function calls active when an exception was thrown, ordered from the throwing line to the original entry point, and identifies the file and line number of each frame.

In simpler words

A stack trace is a breadcrumb trail showing exactly which function called which function, ending at the line that broke.

Read top-down: the top frame is where the error was thrown, and frames below show who called what, down to the HTTP handler.

Match the throwing frame to a pipeline stage, such as a pipe validation error, a guard rejection, a service exception, or a database driver error, to know which layer owns the fix.

A stack trace pointing into a library such as TypeORM usually means the query or entity mapping is wrong upstream in application code, not inside the library itself.

Keep in mind

Reproduce outside the browser before debugging inside it.
A breakpoint beats a console log guess once more than one variable needs inspecting.
Read stack traces top-down and map each frame to a known pipeline stage.

Test

Check your understanding

At least 10 questions — mix of concept, syntax, practical, and logic. Score ≥80% (enforced by the API) to save progress.

Checking your session…

15 questions · concept 5 · syntax 3 · practical 4 · logic 3

1. What is a solid debugging loop?

Concept

Reproduce with Postman/curl, inspect status/body, breakpoint the failing Nest pathAdd console.logs in production and read the aggregated dashboardBisect git history until the failing commit is found firstRestart the API repeatedly until the error stops appearing

2. Why status codes matter?

Syntax

They set the retry interval the browser uses automaticallyThey determine which log level Nest writes the error atThey distinguish 400/401/403/404/500 causes quicklyThey tell the client which guard rejected the request

3. Where do you set Nest breakpoints?

Practical

On the TypeORM-generated SQL inside the database engineIn node_modules where the framework dispatches routesIn the compiled dist output rather than the sourceOn the service/guard/pipe path that should run for the failing request

4. Should you debug exclusively in the web app?

Logic

Yes — a 500 always originates in the React renderNo — Nest may be the failing layerYes — the API only relays what the frontend sendsYes — cookies are set client-side, so bugs are too

5. Why avoid fixing only in production data?

Concept

Production writes bypass the ValidationPipe by defaultLocal databases cannot store the same rows as productionYou need reproducible local evidence and safe iterationEditing production data is blocked by the JWT guard

6. What should you compare on failure?

Practical

The request and response header byte countsThe server and client clock timestampsExpected vs actual status, body shape, and auth stateThe TLS cipher negotiated for each request

7. How do correlation ids help?

Syntax

They let the client retry the exact same request safelyMatch a client error to API logs for one requestThey group all requests from one user sessionThey deduplicate identical requests at the gateway

8. When is an e2e Nest test useful?

Logic

Locking HTTP status and body contracts against regressionsVerifying the internal method call order of a serviceMeasuring the p99 latency of the list endpointChecking that TypeORM entities map to the right tables

9. What does a 401 vs 403 tell you?

Concept

Auth missing/invalid vs authenticated but forbiddenMalformed body vs a missing routeExpired token vs a rate-limited clientMissing header vs a server-side exception

10. Which practice is weakest?

Practical

Reading the error JSON body for the failure reasonReproducing the failure with a curl commandSetting a breakpoint on the failing service methodIgnoring status codes and only watching network timing

11. What does 403 (not 401) tell you here?

Conceptintermediate

// GET /tickets returns 403 with a valid login cookie

Your session cookie has expired and must be refreshedThe route requires a header the client did not sendYou are authenticated but lack the required role or permissionThe ValidationPipe rejected the query parameters

12. The UI shows a blank page for a missing ticket. What does -i reveal?

Syntaxadvanced

curl -i -b jar.txt localhost:3000/tickets/999

The request headers curl sent, not the responseThe HTTP status and headers, revealing e.g. a 404 vs a 200 with nullThe full response body without any header noiseA verbose trace of the TLS handshake

13. How do you use this correlationId?

Practicalintermediate

{ "statusCode": 500, "correlationId": "abc-123" }

Attach it as a bearer token on the retry requestLook it up as the primary key of the failed rowDecode it to recover the user id that made the callSearch the server logs for abc-123 to find the matching request trace

14. What does this e2e test lock in?

Logicadvanced

it('rejects unauth', () => request(app).get('/tickets').expect(401));

That the guard throws a ForbiddenException internallyThat an authenticated request returns the ticket listThat the endpoint responds within the timeoutThe HTTP contract that unauthenticated list requests return 401

15. A valid body still gets 400 on POST /tickets. Where is the first breakpoint?

Conceptintermediate

// 400 on POST /tickets even with a seemingly valid body

In the RolesGuard that runs before the handlerIn the ValidationPipe / DTO path that is rejecting the bodyIn the TypeORM repository’s save methodIn the global exception filter formatting the response

Checking your session…