Why Whitelist and transform options in NestJS? - Purpose & Use Cases

The Big Idea

Discover how to make your API data handling effortless and safe with just a simple setting!

The Scenario

Imagine building an API where users send data, and you manually check each field to accept or reject it.

You also manually convert data types like strings to numbers everywhere in your code.

The Problem

This manual checking and converting is slow, repetitive, and easy to forget.

It leads to bugs, security holes, and messy code that is hard to maintain.

The Solution

Whitelist and transform options in NestJS automatically allow only expected fields and convert data types for you.

This keeps your code clean, safe, and consistent without extra effort.

Before vs After

✗ Before

if (typeof data.age === 'string') { data.age = parseInt(data.age); }
for (const key in data) { if (!['name', 'age'].includes(key)) { delete data[key]; } }

✓ After

app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));

What It Enables

You can trust incoming data is clean and correctly typed, so your app runs smoothly and securely.

Real Life Example

When a user submits a form with extra fields or wrong types, NestJS strips unwanted fields and converts types automatically before your code uses the data.

Key Takeaways

Manual data checks are error-prone and tedious.

Whitelist option removes unexpected fields automatically.

Transform option converts data types for you.

Practice

1. What does the whitelist option do when enabled in NestJS validation pipe?

easy

A. It disables validation for unknown properties.

B. It removes any properties not defined in the DTO from the input data.

C. It transforms input data types to match the DTO automatically.

D. It logs all incoming requests for debugging.

Solution

1. Step 1: Understand the whitelist option purpose

   The whitelist option removes any properties from the input that are not explicitly defined in the DTO (Data Transfer Object).

2. Step 2: Compare with other options

   Transform changes types, logging is unrelated, and disabling validation is not whitelist's role.

3. Final Answer:

   It removes any properties not defined in the DTO from the input data. -> Option B

4. Quick Check:

   Whitelist = remove extra fields [OK]

Hint: Whitelist = remove unwanted fields from input [OK]

Common Mistakes:

• Confusing whitelist with transform option
• Thinking whitelist disables validation
• Assuming whitelist logs data

2. Which is the correct way to enable both whitelist and transform options in a global validation pipe in NestJS?

easy

A. app.useGlobalPipes(new ValidationPipe({ whitelist: false, transform: true }));

B. app.useGlobalPipes(new ValidationPipe(whitelist: true, transform: true));

C. app.useGlobalPipes(new ValidationPipe({ whitelist: 'true', transform: 'true' }));

D. app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));

Solution

1. Step 1: Check the syntax for ValidationPipe options

   Options must be passed as an object with keys and boolean values inside curly braces.

2. Step 2: Validate option values

   Both whitelist and transform must be boolean true, not strings or missing braces.

3. Final Answer:

   app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true })); -> Option D

4. Quick Check:

   Correct object syntax with booleans [OK]

Hint: Use object with booleans inside braces for options [OK]

Common Mistakes:

• Missing curly braces around options
• Using strings instead of booleans
• Setting whitelist to false by mistake

3. Given this DTO and input, what will be the output after validation with whitelist: true and transform: true?

class UserDto {
  name: string;
  age: number;
}

const input = { name: 'Alice', age: '30', extra: 'remove me' };

medium

A. { name: 'Alice', age: 30 }

B. { name: 'Alice', age: '30', extra: 'remove me' }

C. { name: 'Alice', age: 30, extra: 'remove me' }

D. Validation error due to extra property

Solution

1. Step 1: Apply whitelist option

   The extra property 'extra' is removed because whitelist is true.

2. Step 2: Apply transform option

   The age string '30' is converted to number 30 as per DTO type.

3. Final Answer:

   { name: 'Alice', age: 30 } -> Option A

4. Quick Check:

   Whitelist removes extra, transform converts types [OK]

Hint: Whitelist removes extras; transform converts types [OK]

Common Mistakes:

• Expecting extra fields to remain
• Not realizing transform converts string to number
• Thinking validation fails on extra fields with whitelist

4. You set whitelist: true but forgot transform: true in your ValidationPipe. What issue might you face when receiving input with number fields as strings?

medium

A. Input number fields remain strings, causing type errors later.

B. Extra fields are not removed from input.

C. ValidationPipe throws a syntax error.

D. Input is automatically converted to correct types.

Solution

1. Step 1: Understand whitelist without transform

   Whitelist removes extra fields but does not convert types.

2. Step 2: Consequence of missing transform

   Number fields sent as strings remain strings, which can cause errors in code expecting numbers.

3. Final Answer:

   Input number fields remain strings, causing type errors later. -> Option A

4. Quick Check:

   Missing transform = no type conversion [OK]

Hint: Whitelist only removes fields; transform converts types [OK]

Common Mistakes:

• Assuming whitelist converts types
• Expecting syntax errors from missing transform
• Thinking extra fields remain with whitelist true

5. You want to accept a nested object in your DTO and ensure unwanted fields are removed and types are converted. Which ValidationPipe options setup correctly handles nested objects with whitelist and transform?

hard

A. new ValidationPipe({ whitelist: true, transform: true, forbidNonWhitelisted: true })

B. new ValidationPipe({ whitelist: false, transform: true, transformOptions: { enableImplicitConversion: false } })

C. new ValidationPipe({ whitelist: true, transform: true, transformOptions: { enableImplicitConversion: true } })

D. new ValidationPipe({ whitelist: true, transform: false, forbidNonWhitelisted: true })

Solution

1. Step 1: Recognize nested object handling needs transform options

   For nested objects, enabling implicit conversion helps transform nested types correctly.

2. Step 2: Check options for whitelist and transform

   Whitelist true removes unwanted fields; transform true with transformOptions enables nested conversion.

3. Step 3: Compare other options

   Options with forbidNonWhitelisted: true throw errors on extras instead of removing; others disable whitelist or transform or lack transformOptions.

4. Final Answer:

   new ValidationPipe({ whitelist: true, transform: true, transformOptions: { enableImplicitConversion: true } }) -> Option C

5. Quick Check:

   whitelist + transform + enableImplicitConversion [OK]

Hint: Use transformOptions with enableImplicitConversion for nested objects [OK]

Common Mistakes:

• Ignoring transformOptions for nested conversion
• Disabling transform but expecting type conversion
• Not using whitelist to remove extra nested fields