Questions
2 of 12
1How do you apply global middleware, pipes, guards, or interceptors in NestJS?
2What is the APP_GUARD / APP_PIPE token pattern in NestJS?
3What is the difference between app.use() and NestJS middleware?
4What is the difference between a service and a repository in NestJS?
5How does NestJS achieve platform agnosticism between Express and Fastify?
6How does the NestJS bootstrap sequence work?
7What is a barrel module in NestJS and when does it become an anti-pattern?
8How does NestJS resolve a provider when the same token is exported by two different imported modules?
9How do you implement a plugin system using dynamic modules in NestJS?
10How does NestJS handle module initialization order and can you control it?
11How do you unit-test a module that uses a dynamic module dependency in NestJS?
12What is the difference between a monorepo and a standard NestJS project structure?
NestJSNestJS
Basics
Modules
Decorators
Controllers
Dependency Injection
Providers
Architecture
Request Lifecycle
Middleware
Guards
Interceptors
Pipes
Filters
Exception Handling
API Design
GraphQL
Database and ORM
Microservices
Authentication and Authorization
02 / 12

What is the APP_GUARD / APP_PIPE token pattern in NestJS?

Registering a global enhancer through the DI system using special tokens (APP_GUARD, APP_PIPE, APP_INTERCEPTOR, APP_FILTER) so the enhancer can inject services. This is the preferred approach over app.useGlobalGuards() for any enhancer that has dependencies like JwtService or Reflector.

Global guard with injected dependencies
Difficulty: 6/10
Topics: APP_GUARD, APP_PIPE, NestJS lifecycle

Scenario Questions

0-2 years experience
  1. 1

    How would you add a global authentication guard to all routes in a NestJS app using APP_GUARD?

  2. 2

    What happens if you register a validation pipe using APP_PIPE but forget to import ValidationPipe from '@nestjs/common'?

2-5 years experience
  1. 1

    A user reports that POST requests are failing with 400 errors, but the validation pipe logs show no output — how would you debug whether APP_PIPE is even being applied?

  2. 2

    You added a global guard to restrict access to admin routes, but now some public endpoints are blocked — what’s likely wrong, and how would you fix it?

5-8 years experience
  1. 1

    You’re migrating a legacy NestJS app to use modular guards instead of global ones — what edge cases might break when replacing APP_GUARD with module-scoped guards, and how would you test for them?

  2. 2

    How would you design a system where different microservices use different APP_PIPE implementations for request validation, while avoiding duplication and ensuring consistent error responses?

8+ years experience
  1. 1

    You’re leading a cross-team migration from global APP_GUARD/APP_PIPE to per-module implementations across 12 services — what architectural tradeoffs do you consider for maintainability, rollout risk, and observability?

  2. 2

    How would you design a long-term strategy to phase out legacy APP_PIPE logic that’s tightly coupled to deprecated DTOs, while ensuring zero downtime and backward compatibility for external clients?

Follow-up Questions

  • ❓What happens if you register a global pipe that throws an error on invalid input?
  • ❓How would you debug a guard that’s not being triggered on a specific route?
  • ❓Can you use APP_GUARD and APP_PIPE in a feature module, or only globally?