Whitelist and transform options in NestJS - Mini Project: Build & Apply

Whitelist and Transform Options in NestJS

📖 Scenario: You are building a simple NestJS API that accepts user data. To keep your API safe and clean, you want to only allow specific properties from the incoming data and automatically convert data types where needed.

🎯 Goal: Build a NestJS controller that uses ValidationPipe with whitelist and transform options enabled to accept only allowed properties and transform input data types.

📋 What You'll Learn

Create a DTO class CreateUserDto with properties name (string) and age (number)

Set up a controller UsersController with a POST route /users

Use ValidationPipe globally or on the route with whitelist: true and transform: true

Ensure that extra properties sent in the request body are removed and that age is transformed to a number

💡 Why This Matters

🌍 Real World

APIs often receive data from users or other systems. Using whitelist and transform options helps keep data clean and safe by removing unwanted fields and converting types automatically.

💼 Career

Understanding how to validate and sanitize input data is essential for backend developers working with NestJS or similar frameworks to build secure and reliable APIs.

1

Create the DTO class for user data

Create a class called CreateUserDto with two properties: name of type string and age of type number. Use decorators @IsString() for name and @IsNumber() for age from class-validator.

NestJS

import { IsString, IsNumber } from 'class-validator';

// Create the CreateUserDto class with name and age properties
// Your code here

Hint

Use class-validator decorators to specify the types for validation.

2

Set up the UsersController with a POST route

Create a controller class called UsersController with a POST route /users. Add a method createUser that accepts a parameter createUserDto of type CreateUserDto decorated with @Body().

NestJS

import { Controller, Post, Body } from '@nestjs/common';

// Create UsersController with POST /users route and createUser method
// Your code here

Hint

Use @Controller('users') and @Post() decorators to define the route.

3

Enable ValidationPipe with whitelist and transform options

In your main application bootstrap file, import ValidationPipe from @nestjs/common and apply it globally with options whitelist: true and transform: true using app.useGlobalPipes().

NestJS

import { ValidationPipe } from '@nestjs/common';
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);

  // Apply ValidationPipe globally with whitelist and transform options
  // Your code here

  await app.listen(3000);
}
bootstrap();

Hint

Use app.useGlobalPipes() with a new ValidationPipe instance and pass the options object.

4

Complete the setup by exporting the controller and DTO

Ensure that CreateUserDto and UsersController are exported properly from their files so they can be imported in the module.

NestJS

// Check that CreateUserDto and UsersController are exported
// Your code here

Hint

Make sure the classes have the export keyword so they can be imported elsewhere.

Practice

1. What does the whitelist option do when enabled in NestJS validation pipe?

easy

A. It disables validation for unknown properties.

B. It removes any properties not defined in the DTO from the input data.

C. It transforms input data types to match the DTO automatically.

D. It logs all incoming requests for debugging.

Solution

1. Step 1: Understand the whitelist option purpose

   The whitelist option removes any properties from the input that are not explicitly defined in the DTO (Data Transfer Object).

2. Step 2: Compare with other options

   Transform changes types, logging is unrelated, and disabling validation is not whitelist's role.

3. Final Answer:

   It removes any properties not defined in the DTO from the input data. -> Option B

4. Quick Check:

   Whitelist = remove extra fields [OK]

Hint: Whitelist = remove unwanted fields from input [OK]

Common Mistakes:

• Confusing whitelist with transform option
• Thinking whitelist disables validation
• Assuming whitelist logs data

2. Which is the correct way to enable both whitelist and transform options in a global validation pipe in NestJS?

easy

A. app.useGlobalPipes(new ValidationPipe({ whitelist: false, transform: true }));

B. app.useGlobalPipes(new ValidationPipe(whitelist: true, transform: true));

C. app.useGlobalPipes(new ValidationPipe({ whitelist: 'true', transform: 'true' }));

D. app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));

Solution

1. Step 1: Check the syntax for ValidationPipe options

   Options must be passed as an object with keys and boolean values inside curly braces.

2. Step 2: Validate option values

   Both whitelist and transform must be boolean true, not strings or missing braces.

3. Final Answer:

   app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true })); -> Option D

4. Quick Check:

   Correct object syntax with booleans [OK]

Hint: Use object with booleans inside braces for options [OK]

Common Mistakes:

• Missing curly braces around options
• Using strings instead of booleans
• Setting whitelist to false by mistake

3. Given this DTO and input, what will be the output after validation with whitelist: true and transform: true?

class UserDto {
  name: string;
  age: number;
}

const input = { name: 'Alice', age: '30', extra: 'remove me' };

medium

A. { name: 'Alice', age: 30 }

B. { name: 'Alice', age: '30', extra: 'remove me' }

C. { name: 'Alice', age: 30, extra: 'remove me' }

D. Validation error due to extra property

Solution

1. Step 1: Apply whitelist option

   The extra property 'extra' is removed because whitelist is true.

2. Step 2: Apply transform option

   The age string '30' is converted to number 30 as per DTO type.

3. Final Answer:

   { name: 'Alice', age: 30 } -> Option A

4. Quick Check:

   Whitelist removes extra, transform converts types [OK]

Hint: Whitelist removes extras; transform converts types [OK]

Common Mistakes:

• Expecting extra fields to remain
• Not realizing transform converts string to number
• Thinking validation fails on extra fields with whitelist

4. You set whitelist: true but forgot transform: true in your ValidationPipe. What issue might you face when receiving input with number fields as strings?

medium

A. Input number fields remain strings, causing type errors later.

B. Extra fields are not removed from input.

C. ValidationPipe throws a syntax error.

D. Input is automatically converted to correct types.

Solution

1. Step 1: Understand whitelist without transform

   Whitelist removes extra fields but does not convert types.

2. Step 2: Consequence of missing transform

   Number fields sent as strings remain strings, which can cause errors in code expecting numbers.

3. Final Answer:

   Input number fields remain strings, causing type errors later. -> Option A

4. Quick Check:

   Missing transform = no type conversion [OK]

Hint: Whitelist only removes fields; transform converts types [OK]

Common Mistakes:

• Assuming whitelist converts types
• Expecting syntax errors from missing transform
• Thinking extra fields remain with whitelist true

5. You want to accept a nested object in your DTO and ensure unwanted fields are removed and types are converted. Which ValidationPipe options setup correctly handles nested objects with whitelist and transform?

hard

A. new ValidationPipe({ whitelist: true, transform: true, forbidNonWhitelisted: true })

B. new ValidationPipe({ whitelist: false, transform: true, transformOptions: { enableImplicitConversion: false } })

C. new ValidationPipe({ whitelist: true, transform: true, transformOptions: { enableImplicitConversion: true } })

D. new ValidationPipe({ whitelist: true, transform: false, forbidNonWhitelisted: true })

Solution

1. Step 1: Recognize nested object handling needs transform options

   For nested objects, enabling implicit conversion helps transform nested types correctly.

2. Step 2: Check options for whitelist and transform

   Whitelist true removes unwanted fields; transform true with transformOptions enables nested conversion.

3. Step 3: Compare other options

   Options with forbidNonWhitelisted: true throw errors on extras instead of removing; others disable whitelist or transform or lack transformOptions.

4. Final Answer:

   new ValidationPipe({ whitelist: true, transform: true, transformOptions: { enableImplicitConversion: true } }) -> Option C

5. Quick Check:

   whitelist + transform + enableImplicitConversion [OK]

Hint: Use transformOptions with enableImplicitConversion for nested objects [OK]

Common Mistakes:

• Ignoring transformOptions for nested conversion
• Disabling transform but expecting type conversion
• Not using whitelist to remove extra nested fields