Whitelist and transform options in NestJS - Performance & Optimization

Performance: Whitelist and transform options

MEDIUM IMPACT

This affects the request processing speed and memory usage by controlling which properties are accepted and how input data is transformed before reaching business logic.

Validating and transforming incoming request data in NestJS

NestJS

app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));

Automatically removes unwanted properties and converts input types to expected DTO classes, reducing manual work and speeding up processing.

📈 Performance GainSaves CPU cycles by skipping manual filtering and parsing, improves INP by faster validation and transformation.

Validating and transforming incoming request data in NestJS

NestJS

app.useGlobalPipes(new ValidationPipe({ whitelist: false, transform: false }));

Accepts all properties including unwanted ones and does not convert input types, causing extra validation and manual parsing later.

📉 Performance CostTriggers extra CPU cycles for manual checks and can increase memory usage by keeping unwanted data.

Performance Comparison

Pattern	CPU Usage	Memory Usage	Validation Speed	Verdict
Whitelist: false, Transform: false	High (manual checks)	Higher (extra data kept)	Slower (manual parsing)	[X] Bad
Whitelist: true, Transform: true	Lower (automatic filtering)	Lower (only needed data)	Faster (auto conversion)	[OK] Good

Rendering Pipeline

Whitelist and transform options run during the request lifecycle before controller logic, affecting how data is parsed and validated.

→Request Parsing

→Validation

→Transformation

⚠️ BottleneckValidation stage can be costly if whitelist is off and transform is disabled, causing extra manual processing.

Core Web Vital Affected

INP

This affects the request processing speed and memory usage by controlling which properties are accepted and how input data is transformed before reaching business logic.

Optimization Tips

1Always enable whitelist to drop unwanted properties early.

2Enable transform to convert input types automatically.

3Disabling whitelist or transform increases CPU and memory usage.

Performance Quiz - 3 Questions

What is the main performance benefit of enabling whitelist in NestJS ValidationPipe?

A It delays validation until after controller logic.

B It caches all incoming requests for faster access.

C It removes unwanted properties early, reducing processing time.

D It disables all validation to speed up requests.

DevTools: Performance

How to check: Record a profile while sending requests with and without whitelist/transform enabled. Compare CPU time spent in validation and parsing.

What to look for: Look for reduced CPU time and faster function execution in validation pipes when whitelist and transform are enabled.

Practice

1. What does the whitelist option do when enabled in NestJS validation pipe?

easy

A. It disables validation for unknown properties.

B. It removes any properties not defined in the DTO from the input data.

C. It transforms input data types to match the DTO automatically.

D. It logs all incoming requests for debugging.

Solution

1. Step 1: Understand the whitelist option purpose

   The whitelist option removes any properties from the input that are not explicitly defined in the DTO (Data Transfer Object).

2. Step 2: Compare with other options

   Transform changes types, logging is unrelated, and disabling validation is not whitelist's role.

3. Final Answer:

   It removes any properties not defined in the DTO from the input data. -> Option B

4. Quick Check:

   Whitelist = remove extra fields [OK]

Hint: Whitelist = remove unwanted fields from input [OK]

Common Mistakes:

• Confusing whitelist with transform option
• Thinking whitelist disables validation
• Assuming whitelist logs data

2. Which is the correct way to enable both whitelist and transform options in a global validation pipe in NestJS?

easy

A. app.useGlobalPipes(new ValidationPipe({ whitelist: false, transform: true }));

B. app.useGlobalPipes(new ValidationPipe(whitelist: true, transform: true));

C. app.useGlobalPipes(new ValidationPipe({ whitelist: 'true', transform: 'true' }));

D. app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));

Solution

1. Step 1: Check the syntax for ValidationPipe options

   Options must be passed as an object with keys and boolean values inside curly braces.

2. Step 2: Validate option values

   Both whitelist and transform must be boolean true, not strings or missing braces.

3. Final Answer:

   app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true })); -> Option D

4. Quick Check:

   Correct object syntax with booleans [OK]

Hint: Use object with booleans inside braces for options [OK]

Common Mistakes:

• Missing curly braces around options
• Using strings instead of booleans
• Setting whitelist to false by mistake

3. Given this DTO and input, what will be the output after validation with whitelist: true and transform: true?

class UserDto {
  name: string;
  age: number;
}

const input = { name: 'Alice', age: '30', extra: 'remove me' };

medium

A. { name: 'Alice', age: 30 }

B. { name: 'Alice', age: '30', extra: 'remove me' }

C. { name: 'Alice', age: 30, extra: 'remove me' }

D. Validation error due to extra property

Solution

1. Step 1: Apply whitelist option

   The extra property 'extra' is removed because whitelist is true.

2. Step 2: Apply transform option

   The age string '30' is converted to number 30 as per DTO type.

3. Final Answer:

   { name: 'Alice', age: 30 } -> Option A

4. Quick Check:

   Whitelist removes extra, transform converts types [OK]

Hint: Whitelist removes extras; transform converts types [OK]

Common Mistakes:

• Expecting extra fields to remain
• Not realizing transform converts string to number
• Thinking validation fails on extra fields with whitelist

4. You set whitelist: true but forgot transform: true in your ValidationPipe. What issue might you face when receiving input with number fields as strings?

medium

A. Input number fields remain strings, causing type errors later.

B. Extra fields are not removed from input.

C. ValidationPipe throws a syntax error.

D. Input is automatically converted to correct types.

Solution

1. Step 1: Understand whitelist without transform

   Whitelist removes extra fields but does not convert types.

2. Step 2: Consequence of missing transform

   Number fields sent as strings remain strings, which can cause errors in code expecting numbers.

3. Final Answer:

   Input number fields remain strings, causing type errors later. -> Option A

4. Quick Check:

   Missing transform = no type conversion [OK]

Hint: Whitelist only removes fields; transform converts types [OK]

Common Mistakes:

• Assuming whitelist converts types
• Expecting syntax errors from missing transform
• Thinking extra fields remain with whitelist true

5. You want to accept a nested object in your DTO and ensure unwanted fields are removed and types are converted. Which ValidationPipe options setup correctly handles nested objects with whitelist and transform?

hard

A. new ValidationPipe({ whitelist: true, transform: true, forbidNonWhitelisted: true })

B. new ValidationPipe({ whitelist: false, transform: true, transformOptions: { enableImplicitConversion: false } })

C. new ValidationPipe({ whitelist: true, transform: true, transformOptions: { enableImplicitConversion: true } })

D. new ValidationPipe({ whitelist: true, transform: false, forbidNonWhitelisted: true })

Solution

1. Step 1: Recognize nested object handling needs transform options

   For nested objects, enabling implicit conversion helps transform nested types correctly.

2. Step 2: Check options for whitelist and transform

   Whitelist true removes unwanted fields; transform true with transformOptions enables nested conversion.

3. Step 3: Compare other options

   Options with forbidNonWhitelisted: true throw errors on extras instead of removing; others disable whitelist or transform or lack transformOptions.

4. Final Answer:

   new ValidationPipe({ whitelist: true, transform: true, transformOptions: { enableImplicitConversion: true } }) -> Option C

5. Quick Check:

   whitelist + transform + enableImplicitConversion [OK]

Hint: Use transformOptions with enableImplicitConversion for nested objects [OK]

Common Mistakes:

• Ignoring transformOptions for nested conversion
• Disabling transform but expecting type conversion
• Not using whitelist to remove extra nested fields