What is the APP_GUARD / APP_PIPE token pattern in NestJS?

Q: What is the APP_GUARD / APP_PIPE token pattern in NestJS?

// jwt-auth.guard.ts @Injectable() export class JwtAuthGuard implements CanActivate { constructor( private jwtService: JwtService, private reflector: Reflector, // can inject because registered via DI ) {} canActivate(context: ExecutionContext): boolean { const isPublic = this.reflector.getAllAndOverride ('isPublic', [ context.getHandler(), context.getClass(), ]); if (isPublic) return true; // verify JWT... return true; } } // app.module.ts @Module({ providers: [ { provide: APP_GUARD, useClass: JwtAuthGuard }, ], }) export class AppModule {}

Difficulty: 6/10

APP_GUARD, APP_PIPE, NestJS lifecycle

Registering a global enhancer through the DI system using special tokens (APP_GUARD, APP_PIPE, APP_INTERCEPTOR, APP_FILTER) so the enhancer can inject services. This is the preferred approach over app.useGlobalGuards() for any enhancer that has dependencies like JwtService or Reflector.

Global guard with injected dependencies

Scenario Questions

0-2 years experience

1How would you add a global authentication guard to all routes in a NestJS app using APP_GUARD?
2What happens if you register a validation pipe using APP_PIPE but forget to import ValidationPipe from '@nestjs/common'?

2-5 years experience

1A user reports that POST requests are failing with 400 errors, but the validation pipe logs show no output — how would you debug whether APP_PIPE is even being applied?

Follow-up Questions

What happens if you register a global pipe that throws an error on invalid input?
How would you debug a guard that’s not being triggered on a specific route?
Can you use APP_GUARD and APP_PIPE in a feature module, or only globally?