Skip to main content

Global Middleware

Middleware is code that runs between "a request arrived" and "your route handles it", a checkpoint every request passes through first, free to inspect the request, change it, reject it outright, or let it continue.

RapidREST already gives you a way to attach checkpoint-like behavior to one specific route: decorators, an auth strategy, @RequiresRole, @Validate, all covered in Lifecycle & Validation. Reach for that first, it keeps a rule attached to exactly the endpoint it governs. Global middleware is for the rarer case where a rule genuinely doesn't belong to any one route at all.

What's already running on every request​

Every page in this section so far is, internally, exactly this: middleware RapidREST registers once and runs for every request before route matching even happens. Error Handling sits at the end of the chain catching whatever the rest of it didn't. Cookies & CORS and Sessions run early, before your route sees the request. Prometheus metrics (see Default Routes → Metrics) are recorded the same way. None of these are things you wire up, they're already running, this is just what they're built from.

Writing your own​

The only time you'd reach for this yourself is assembling service-core into a project by hand and needing something to run unconditionally on every request, regardless of route:

server.getApplication().use(async (req, res, next) => {
  // runs before route matching, for every request
  next();
});

The (req, res, next) shape is the same convention Express middleware uses, and Error Handling covers the four-argument error-handler variant of it.

Deciding which one to reach for​

Is the rule about one route, a handful of related routes, or genuinely everything? For anything scoped to specific routes, even a lot of them, decorators are almost always the better fit, the rule stays visible right next to the code it affects instead of living in a separate file a reader has to already know to check. Global middleware earns its keep only for the rare rule that has nothing to do with which route is being called at all.