How do you apply global middleware, pipes, guards, or interceptors in NestJS?

Q: How do you apply global middleware, pipes, guards, or interceptors in NestJS?

// Option 1: app.useGlobal*() — no DI support async function bootstrap() { const app = await NestFactory.create(AppModule); app.useGlobalPipes(new ValidationPipe()); app.useGlobalGuards(new AuthGuard()); await app.listen(3000); } // Option 2: APP_* tokens — full DI support (preferred) @Module({ providers: [ { provide: APP_PIPE, useClass: ValidationPipe }, { provide: APP_GUARD, useClass: JwtAuthGuard }, { provide: APP_INTERCEPTOR, useClass: LoggingInterceptor }, { provide: APP_FILTER, useClass: HttpExceptionFilter }, ], }) export class AppModule {} app.useGlobal*() — simple but cannot inject services; use for dependency-free enhancers. APP_* tokens — registered inside the DI container; supports full constructor injection. The APP_* token approach is preferred for any enhancer that has dependencies.

Difficulty: 6/10

Middleware, Interceptors, Guards

Use app.useGlobalPipes(), app.useGlobalGuards(), app.useGlobalInterceptors(), and app.useGlobalFilters(). These bypass DI so they cannot inject services. To use DI, register globals inside a module using the APP_GUARD, APP_PIPE, APP_INTERCEPTOR, or APP_FILTER tokens.

Two ways to register global enhancers

Key difference:

1
app.useGlobal*() — simple but cannot inject services; use for dependency-free enhancers.
2
APP_* tokens — registered inside the DI container; supports full constructor injection.
3
The APP_* token approach is preferred for any enhancer that has dependencies.

Scenario Questions

0-2 years experience

1How would you add a global middleware in NestJS to log every incoming request URL and method?
2What happens if you register a global guard that always returns false — will any endpoint still work?

2-5 years experience

1Our global interceptor is modifying the response body, but one endpoint now returns a file stream — the file is corrupted. How do you fix this without removing the interceptor?

Follow-up Questions

What happens if you register a global guard that throws an error before the controller is reached?
How would you debug a global interceptor that’s not being called on a specific route?
Can you apply a middleware globally but exclude it for certain paths?