ValidationPipe setup in NestJS - Mini Project: Build & Apply

ValidationPipe setup

📖 Scenario: You are building a simple NestJS API that accepts user data. To keep your API safe and clean, you want to add validation to the incoming data.

🎯 Goal: Set up a ValidationPipe in your NestJS application to automatically validate incoming requests based on DTO rules.

📋 What You'll Learn

Create a DTO class with validation decorators

Create a ValidationPipe instance with whitelist enabled

Apply the ValidationPipe globally in the main application bootstrap

Ensure the application uses the DTO and validation pipe correctly

💡 Why This Matters

🌍 Real World

ValidationPipe helps keep APIs safe by checking incoming data automatically, preventing bad or unexpected data from causing errors or security issues.

💼 Career

Backend developers often use ValidationPipe in NestJS to enforce data rules and improve API reliability and security.

1

Create a User DTO with validation decorators

Create a class called CreateUserDto with two properties: username and age. Use @IsString() decorator on username and @IsInt() decorator on age from the class-validator package.

NestJS

# Create the CreateUserDto class with username and age properties
# Use @IsString() on username and @IsInt() on age
# Your code here

Hint

Remember to import IsString and IsInt from class-validator.

2

Create a ValidationPipe instance with whitelist enabled

Create a constant called validationPipe and assign it a new ValidationPipe instance with the option whitelist: true.

NestJS

import { ValidationPipe } from '@nestjs/common';

// Create validationPipe with whitelist enabled
# Your code here

Hint

Use new ValidationPipe({ whitelist: true }) to create the pipe.

3

Apply the ValidationPipe globally in the main bootstrap function

In the bootstrap function, after creating the app with NestFactory.create(AppModule), apply the validationPipe globally using app.useGlobalPipes(validationPipe).

NestJS

import { IsString, IsInt } from 'class-validator';
import { ValidationPipe } from '@nestjs/common';
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

export class CreateUserDto {
  @IsString()
  username: string;

  @IsInt()
  age: number;
}

const validationPipe = new ValidationPipe({ whitelist: true });

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  
  // Apply validationPipe globally
  # Your code here

  await app.listen(3000);
}

bootstrap();

Hint

Use app.useGlobalPipes(validationPipe) to apply the pipe globally.

4

Use the CreateUserDto in a controller method

In a controller method, add a parameter called createUserDto of type CreateUserDto decorated with @Body() to receive and validate incoming user data.

NestJS

import { IsString, IsInt } from 'class-validator';
import { ValidationPipe } from '@nestjs/common';
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';
import { Controller, Post, Body } from '@nestjs/common';

export class CreateUserDto {
  @IsString()
  username: string;

  @IsInt()
  age: number;
}

const validationPipe = new ValidationPipe({ whitelist: true });

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.useGlobalPipes(validationPipe);
  await app.listen(3000);
}

bootstrap();

@Controller('users')
export class UsersController {
  @Post()
  create(
    // Add a parameter called createUserDto of type CreateUserDto decorated with @Body()
    # Your code here
  ) {
    return 'User created';
  }
}

Hint

Use @Body() createUserDto: CreateUserDto as the method parameter.

Practice

1. What is the main purpose of using ValidationPipe in a NestJS application?

easy

A. To serve static files like images and CSS

B. To handle database connections automatically

C. To check and clean incoming data to ensure it is safe and correct

D. To manage user authentication and authorization

Solution

1. Step 1: Understand ValidationPipe role

   ValidationPipe is designed to validate and sanitize incoming data in NestJS, ensuring the data meets expected rules.

2. Step 2: Compare with other options

   Other options like database handling, authentication, or serving static files are unrelated to ValidationPipe's purpose.

3. Final Answer:

   To check and clean incoming data to ensure it is safe and correct -> Option C

4. Quick Check:

   ValidationPipe purpose = data validation and cleaning [OK]

Hint: ValidationPipe is all about checking incoming data [OK]

Common Mistakes:

• Confusing ValidationPipe with authentication features
• Thinking ValidationPipe manages database connections
• Assuming ValidationPipe serves static files

2. Which is the correct way to apply ValidationPipe globally in a NestJS app inside main.ts?

easy

A. app.useGlobalPipes(new ValidationPipe())

B. app.usePipes(new ValidationPipe())

C. app.setGlobalPipes(new ValidationPipe())

D. app.applyGlobalPipes(new ValidationPipe())

Solution

1. Step 1: Recall NestJS global pipe method

   The official method to set global pipes is app.useGlobalPipes().

2. Step 2: Check other options

   Methods like usePipes, setGlobalPipes, or applyGlobalPipes do not exist or are incorrect.

3. Final Answer:

   app.useGlobalPipes(new ValidationPipe()) -> Option A

4. Quick Check:

   Global pipe setup = useGlobalPipes() [OK]

Hint: Global pipes use app.useGlobalPipes() [OK]

Common Mistakes:

• Using non-existent methods like setGlobalPipes
• Confusing useGlobalPipes with usePipes
• Missing the 'new' keyword before ValidationPipe

3. Given this main.ts snippet, what will happen when a request sends extra properties not defined in the DTO?

app.useGlobalPipes(new ValidationPipe({ whitelist: true }));

medium

A. The request will fail with a validation error

B. Extra properties will be removed from the incoming data

C. Extra properties will be kept without changes

D. The app will crash due to unknown properties

Solution

1. Step 1: Understand whitelist option in ValidationPipe

   Setting whitelist: true removes any properties not defined in the DTO from the incoming data.

2. Step 2: Check behavior on extra properties

   With whitelist true, extra properties are stripped, not causing errors or crashes.

3. Final Answer:

   Extra properties will be removed from the incoming data -> Option B

4. Quick Check:

   whitelist true = remove extra props [OK]

Hint: whitelist true strips unknown properties [OK]

Common Mistakes:

• Thinking whitelist causes validation errors on extra props
• Assuming extra props are kept unchanged
• Believing app crashes on extra properties

4. What is wrong with this main.ts code snippet for setting up ValidationPipe globally?

app.useGlobalPipes(ValidationPipe({ transform: true }));

medium

A. Missing 'new' keyword before ValidationPipe

B. The 'transform' option is invalid

C. useGlobalPipes should be called inside a controller

D. ValidationPipe cannot be used globally

Solution

1. Step 1: Check ValidationPipe instantiation

   ValidationPipe is a class and must be instantiated with the new keyword.

2. Step 2: Validate other parts

   The transform option is valid, and useGlobalPipes is correctly used in main.ts.

3. Final Answer:

   Missing 'new' keyword before ValidationPipe -> Option A

4. Quick Check:

   Instantiate ValidationPipe with new [OK]

Hint: Always use 'new' with ValidationPipe class [OK]

Common Mistakes:

• Omitting 'new' keyword when creating ValidationPipe
• Thinking transform option is invalid
• Trying to set global pipes inside controllers

5. You want to automatically convert incoming JSON strings to their expected types in your DTOs. Which ValidationPipe option should you enable globally to achieve this?

hard

A. forbidNonWhitelisted: true

B. whitelist: true

C. disableErrorMessages: true

D. transform: true

Solution

1. Step 1: Understand transform option

   Setting transform: true tells ValidationPipe to convert incoming payloads to the types defined in DTO classes automatically.

2. Step 2: Check other options

   whitelist removes extra properties, forbidNonWhitelisted throws errors on extra props, and disableErrorMessages hides validation errors; none convert types.

3. Final Answer:

   transform: true -> Option D

4. Quick Check:

   transform true = auto type conversion [OK]

Hint: Use transform true to convert types automatically [OK]

Common Mistakes:

• Confusing whitelist with type conversion
• Thinking forbidNonWhitelisted converts types
• Believing disableErrorMessages affects data types