HTTP
The HTTP transport — controllers, routes, configuration, TLS, CORS.
NestRS’s HTTP layer is built on poem — listener,
extractors, middleware. NestRS wraps it so a controller is a struct, routes
come from #[routes], and the transport activates by importing
HttpModule::for_root(...) in AppModule.imports
— main never holds a transport.
Other HTTP-shaped surfaces — GraphQL, OpenAPI, MCP, WebSocket gateways —
all mount on the same HttpTransport via HttpEndpointMeta, so a single
binding (0.0.0.0:3002) serves them all. None of them runs its own port.
This category covers HTTP only — controllers, routes, response shaping, transport configuration. Authentication, authorization, and database queries each have their own category.
Install
Section titled “Install”cargo add nest-rs --features httpThat is the whole manifest for a controller. The http feature carries the
per-route guard chain, the pipe fold and the interceptor / filter /
exception-filter sites that #[controller] and #[routes] expand to — none of
which is a crate you name.
In this section
Section titled “In this section”Basics
Section titled “Basics”- Controllers & routes —
#[controller],#[routes], path/query/JSON extractors, typed returns. - Responses —
Json<T>, status + body tuples,#[http_code],#[response_header],#[redirect]. - Errors —
ResponseErroron a feature error enum, RFC 9457ProblemDetailsfor one-off problem responses. - Extractors — the full extractor surface:
RawBody,ClientIp,Scoped<T>,Ctx<T>,Reflector+#[meta(...)].
All options
Section titled “All options”- Configuration —
HttpConfig, env vars vs pinned struct, TLS, CORS, the frameworkServer:header. - Versioning —
#[controller(version = "1")]and multi-version controllers. - Compression — gzip/brotli negotiated from
Accept-Encoding, behind oneHttpConfigflag. - Streaming responses — a chunked body or a Server-Sent Events stream returned from a handler.
- File uploads — a
multipart/form-datapart streamed straight into object storage.
Going further
Section titled “Going further”- OpenAPI — a self-composing OpenAPI 3.1 document and Swagger UI, read off the routes above.
- Security — bind an
AuthnGuardand anAbilityGuardto attach the principal and gate actions per row. - GraphQL, WebSockets, MCP — each
mounts on the same
HttpTransportyou configured here.