ValidationPipe in depth in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when ValidationPipe is used globally with transform enabled?

Consider a NestJS app where ValidationPipe is applied globally with transform: true. What is the output type of a controller method receiving a DTO?

NestJS

app.useGlobalPipes(new ValidationPipe({ transform: true }));

@Post()
create(@Body() createDto: CreateDto) {
  return typeof createDto;
}

A "undefined"

B "object"

C "number"

D "string"

💡 Hint

Think about what transform: true does to the incoming data.

With transform: true, the incoming JSON is converted to an instance of the DTO class, so typeof createDto is "object".

📝 Syntax

intermediate

Which option correctly enables whitelist and forbids non-whitelisted properties?

Choose the correct way to configure ValidationPipe to remove properties not in the DTO and throw an error if extra properties are present.

A new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true })

B new ValidationPipe({ whitelist: false, forbidNonWhitelisted: false })

C new ValidationPipe({ whitelist: true, forbidNonWhitelisted: false })

D new ValidationPipe({ whitelist: false, forbidNonWhitelisted: true })

💡 Hint

Whitelist removes extra properties. ForbidNonWhitelisted throws error on extra properties.

Setting whitelist: true removes extra properties. Setting forbidNonWhitelisted: true makes the pipe throw an error if extra properties are found.

🔧 Debug

advanced

Why does ValidationPipe not validate nested objects by default?

Given a DTO with a nested object property, why does ValidationPipe skip validating the nested object?

Example DTO:

class AddressDto {
  @IsString()
  street: string;
}

class UserDto {
  @ValidateNested()
  @Type(() => AddressDto)
  address: AddressDto;
}

A Because ValidationPipe needs <code>transform: true</code> to convert nested objects before validation

B Because <code>ValidateNested</code> and <code>Type</code> decorators are missing or misused

C Because ValidationPipe requires <code>enableImplicitConversion</code> to validate nested objects

D Because ValidationPipe does not support nested validation at all

💡 Hint

Think about how nested objects are converted before validation.

ValidationPipe requires transform: true to convert nested plain objects into class instances so that nested validation decorators work properly.

❓ state_output

advanced

What error message is returned when forbidNonWhitelisted is true and extra properties exist?

When ValidationPipe is configured with forbidNonWhitelisted: true and the request body contains extra properties not in the DTO, what is the typical error message returned?

A "Extra properties detected: extra"

B "Validation failed: extra is not allowed"

C "Unexpected property found: extra"

D "property 'extra' should not exist"

💡 Hint

Look for the exact wording from class-validator errors.

The error message from class-validator when forbidding non-whitelisted properties is typically: "property 'extra' should not exist".

🧠 Conceptual

expert

How does ValidationPipe interact with custom validators and async validation?

When using custom async validators in DTOs, how does ValidationPipe handle the validation process?

A ValidationPipe runs async validators but does not wait for their completion, causing possible false positives

B ValidationPipe ignores async validators and only runs synchronous ones

C ValidationPipe waits for all async validators to complete before returning the result

D ValidationPipe requires a special flag to enable async validation

💡 Hint

Think about how async validation integrates with the validation lifecycle.

ValidationPipe supports async validators and waits for all promises to resolve before returning validation results.

Practice

1. What is the main purpose of ValidationPipe in a NestJS application?

easy

A. To check and clean incoming data before it is used

B. To handle database connections automatically

C. To manage user authentication and sessions

D. To serve static files like images and CSS

Solution

1. Step 1: Understand ValidationPipe role

   ValidationPipe is designed to validate and sanitize incoming request data to ensure it meets expected rules.

2. Step 2: Compare with other options

   Options B, C, and D relate to other parts of NestJS or web apps, not data validation.

3. Final Answer:

   To check and clean incoming data before it is used -> Option A

4. Quick Check:

   ValidationPipe purpose = data validation [OK]

Hint: ValidationPipe = data check and clean before use [OK]

Common Mistakes:

• Confusing ValidationPipe with authentication or database handling
• Thinking ValidationPipe serves static files
• Assuming ValidationPipe manages sessions

2. Which of the following is the correct way to enable automatic transformation of input data types using ValidationPipe in NestJS?

easy

A. new ValidationPipe({ forbidNonWhitelisted: true })

B. new ValidationPipe({ whitelist: true })

C. new ValidationPipe({ transform: true })

D. new ValidationPipe({ skipMissingProperties: true })

Solution

1. Step 1: Identify transform option

   The transform: true option enables automatic conversion of input data types to expected types.

2. Step 2: Understand other options

   whitelist removes unwanted properties, forbidNonWhitelisted throws error on extra props, skipMissingProperties skips validation for missing props.

3. Final Answer:

   new ValidationPipe({ transform: true }) -> Option C

4. Quick Check:

   transform option enables type conversion [OK]

Hint: Use transform: true to convert input types automatically [OK]

Common Mistakes:

• Confusing whitelist with transform
• Using forbidNonWhitelisted to transform data
• Thinking skipMissingProperties enables transformation

3. Given this DTO and ValidationPipe setup, what will be the output when sending { "age": "25" } in the request body?

class UserDto {
  @IsInt()
  age: number;
}

// In controller
@Post()
create(@Body(new ValidationPipe({ transform: true })) user: UserDto) {
  return typeof user.age;
}

medium

A. "string"

B. "undefined"

C. Validation error thrown

D. "number"

Solution

1. Step 1: Check ValidationPipe transform option

   Transform is true, so input string "25" will be converted to number 25.

2. Step 2: Determine returned type

   Since age is transformed to number, typeof user.age returns "number".

3. Final Answer:

   "number" -> Option D

4. Quick Check:

   transform converts string to number, so typeof = "number" [OK]

Hint: transform: true converts strings to numbers automatically [OK]

Common Mistakes:

• Assuming input stays string without transform
• Expecting validation error for string number
• Thinking age is undefined without explicit conversion

4. Identify the error in this ValidationPipe usage that causes unexpected behavior:

@Post()
create(@Body(new ValidationPipe({ whitelist: true })) user: UserDto) {
  return user;
}

// UserDto has properties: name (string), age (number)

Request body: { "name": "Alice", "age": 30, "extra": "value" }

medium

A. The ValidationPipe should have forbidNonWhitelisted to throw error on extra props

B. The whitelist option removes the extra property silently

C. The ValidationPipe is missing transform: true to convert types

D. The extra property causes a validation error

Solution

1. Step 1: Understand whitelist behavior

   Whitelist removes properties not in DTO silently without error.

2. Step 2: Check how to throw error on extra props

   To throw error on extra properties, forbidNonWhitelisted: true must be set.

3. Final Answer:

   The ValidationPipe should have forbidNonWhitelisted to throw error on extra props -> Option A

4. Quick Check:

   forbidNonWhitelisted throws error on extra props [OK]

Hint: Use forbidNonWhitelisted to reject extra properties with error [OK]

Common Mistakes:

• Thinking whitelist throws error by default
• Ignoring need for forbidNonWhitelisted option
• Confusing whitelist with transform option

5. You want to ensure that your NestJS API only accepts properties defined in your DTO, automatically converts input types, and throws an error if extra properties are sent. Which ValidationPipe configuration achieves this?

hard

A. new ValidationPipe({ whitelist: true, transform: true })

B. new ValidationPipe({ whitelist: true, transform: true, forbidNonWhitelisted: true })

C. new ValidationPipe({ transform: true, skipMissingProperties: true })

D. new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true })

Solution

1. Step 1: Identify needed options

   Whitelist removes extra props, transform converts types, forbidNonWhitelisted throws error on extra props.

2. Step 2: Match options to requirements

   Only new ValidationPipe({ whitelist: true, transform: true, forbidNonWhitelisted: true }) includes all three: whitelist, transform, and forbidNonWhitelisted.

3. Final Answer:

   new ValidationPipe({ whitelist: true, transform: true, forbidNonWhitelisted: true }) -> Option B

4. Quick Check:

   Whitelist + transform + forbidNonWhitelisted = strict validation [OK]

Hint: Combine whitelist, transform, forbidNonWhitelisted for strict validation [OK]

Common Mistakes:

• Omitting forbidNonWhitelisted to throw errors
• Forgetting transform for type conversion
• Using skipMissingProperties instead of forbidNonWhitelisted