The request lifecycle

The order every request travels

The pipe didn't run by magic — it runs at a fixed point in Nest's request lifecycle. Every incoming request flows through the same ordered pipeline, and knowing the order is what lets you put logic in the right place:

  1. Middleware — runs first, before Nest even knows the route (raw req/res; good for logging, CORS, body parsing).
  2. Guards — answer one yes/no question: is this request allowed? (auth, roles). A false here stops everything with a 403.
  3. Interceptors (pre) — wrap the handler; the code before next runs on the way in.
  4. Pipes — transform and validate the handler's arguments. This is where your ValidationPipe lives.
  5. The route handler — your controller method, finally running on clean, authorized input.
  6. Interceptors (post) — the code after next, on the way out (reshape the response, log timing).
  7. Exception filters — catch anything thrown at any stage and turn it into an HTTP response.

In an interview, say: "Guards decide if the request runs, pipes decide whether the input is valid — so authorization is settled before validation, and both before my handler sees anything."