ValidationPipe in depth in NestJS - Step-by-Step Execution

Concept Flow - ValidationPipe in depth

Request Received

↓

Apply ValidationPipe

↓

Transform Input to DTO

↓

Validate DTO Properties

↓

Send Response

The ValidationPipe intercepts incoming requests, transforms and validates data against DTO rules, then either passes valid data to the controller or throws errors for invalid input.

Execution Sample

NestJS

import { ValidationPipe } from '@nestjs/common';

app.useGlobalPipes(new ValidationPipe({ whitelist: true }));

This code sets up a global ValidationPipe that automatically validates and strips unwanted properties from incoming requests.

Execution Table

Step	Action	Input Data	Validation Result	Outcome
1	Request received	{"name":"John","age":30}	Not validated yet	Proceed to ValidationPipe
2	Transform input to DTO	{"name":"John","age":30}	DTO created with name and age	Ready for validation
3	Validate DTO properties	{"name":"John","age":30}	All properties valid	Pass data to controller
4	Controller handles data	{"name":"John","age":30}	No validation errors	Process request normally
5	Request received	{"name":"John","age":"thirty"}	Not validated yet	Proceed to ValidationPipe
6	Transform input to DTO	{"name":"John","age":"thirty"}	DTO created with name and age	Ready for validation
7	Validate DTO properties	{"name":"John","age":"thirty"}	Age is not a number	Throw validation exception
8	Send error response	{"name":"John","age":"thirty"}	Validation failed	Respond with 400 Bad Request

💡 Execution stops when validation fails or data passes successfully to the controller.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 7	Final
inputData	undefined	{"name":"John","age":30}	{"name":"John","age":30}	{"name":"John","age":"thirty"}	Depends on validation result
validationResult	undefined	pending	valid	invalid	valid or error thrown
errorThrown	false	false	false	true	false or true

Key Moments - 3 Insights

Why does ValidationPipe throw an error when age is a string instead of a number?

Because the DTO expects age as a number, and ValidationPipe checks types strictly (see execution_table step 7). If the type doesn't match, it throws an error.

What does the whitelist option do in ValidationPipe?

It removes any properties not defined in the DTO from the incoming data before validation, ensuring only expected data is processed (refer to execution_sample code).

When does the controller receive the data?

Only after ValidationPipe validates the input successfully without errors (see execution_table step 4). If validation fails, the controller is not called.

Visual Quiz - 3 Questions

Look at the execution_table, what is the validation result at step 3?

A Not validated yet

B All properties valid

C Age is not a number

D Validation failed

💡 Hint

Check the 'Validation Result' column at step 3 in the execution_table.

At which step does the ValidationPipe throw a validation exception?

A Step 7

B Step 4

C Step 2

D Step 1

💡 Hint

Look for the step where 'Throw validation exception' appears in the 'Outcome' column.

If the whitelist option is enabled, what happens to extra properties not in the DTO?

A They are kept and passed to the controller

B They cause validation to fail

C They are removed before validation

D They are converted to null

💡 Hint

Refer to the execution_sample description about the whitelist option.

Concept Snapshot

ValidationPipe intercepts incoming requests
Transforms input to DTO instances
Validates DTO properties strictly
Throws errors on invalid data
Whitelist option removes unexpected properties
Passes valid data to controller

Full Transcript

ValidationPipe in NestJS is a tool that checks incoming request data against defined rules in DTO classes. When a request arrives, ValidationPipe transforms the raw input into a DTO object. It then validates each property according to the DTO's rules, such as type and required fields. If the data is valid, it passes the cleaned data to the controller to handle. If invalid, it throws an error and sends a 400 Bad Request response. The whitelist option helps by removing any extra properties not defined in the DTO, keeping data clean and safe. This process ensures your app only works with correct and expected data.

Practice

1. What is the main purpose of ValidationPipe in a NestJS application?

easy

A. To check and clean incoming data before it is used

B. To handle database connections automatically

C. To manage user authentication and sessions

D. To serve static files like images and CSS

Solution

1. Step 1: Understand ValidationPipe role

   ValidationPipe is designed to validate and sanitize incoming request data to ensure it meets expected rules.

2. Step 2: Compare with other options

   Options B, C, and D relate to other parts of NestJS or web apps, not data validation.

3. Final Answer:

   To check and clean incoming data before it is used -> Option A

4. Quick Check:

   ValidationPipe purpose = data validation [OK]

Hint: ValidationPipe = data check and clean before use [OK]

Common Mistakes:

• Confusing ValidationPipe with authentication or database handling
• Thinking ValidationPipe serves static files
• Assuming ValidationPipe manages sessions

2. Which of the following is the correct way to enable automatic transformation of input data types using ValidationPipe in NestJS?

easy

A. new ValidationPipe({ forbidNonWhitelisted: true })

B. new ValidationPipe({ whitelist: true })

C. new ValidationPipe({ transform: true })

D. new ValidationPipe({ skipMissingProperties: true })

Solution

1. Step 1: Identify transform option

   The transform: true option enables automatic conversion of input data types to expected types.

2. Step 2: Understand other options

   whitelist removes unwanted properties, forbidNonWhitelisted throws error on extra props, skipMissingProperties skips validation for missing props.

3. Final Answer:

   new ValidationPipe({ transform: true }) -> Option C

4. Quick Check:

   transform option enables type conversion [OK]

Hint: Use transform: true to convert input types automatically [OK]

Common Mistakes:

• Confusing whitelist with transform
• Using forbidNonWhitelisted to transform data
• Thinking skipMissingProperties enables transformation

3. Given this DTO and ValidationPipe setup, what will be the output when sending { "age": "25" } in the request body?

class UserDto {
  @IsInt()
  age: number;
}

// In controller
@Post()
create(@Body(new ValidationPipe({ transform: true })) user: UserDto) {
  return typeof user.age;
}

medium

A. "string"

B. "undefined"

C. Validation error thrown

D. "number"

Solution

1. Step 1: Check ValidationPipe transform option

   Transform is true, so input string "25" will be converted to number 25.

2. Step 2: Determine returned type

   Since age is transformed to number, typeof user.age returns "number".

3. Final Answer:

   "number" -> Option D

4. Quick Check:

   transform converts string to number, so typeof = "number" [OK]

Hint: transform: true converts strings to numbers automatically [OK]

Common Mistakes:

• Assuming input stays string without transform
• Expecting validation error for string number
• Thinking age is undefined without explicit conversion

4. Identify the error in this ValidationPipe usage that causes unexpected behavior:

@Post()
create(@Body(new ValidationPipe({ whitelist: true })) user: UserDto) {
  return user;
}

// UserDto has properties: name (string), age (number)

Request body: { "name": "Alice", "age": 30, "extra": "value" }

medium

A. The ValidationPipe should have forbidNonWhitelisted to throw error on extra props

B. The whitelist option removes the extra property silently

C. The ValidationPipe is missing transform: true to convert types

D. The extra property causes a validation error

Solution

1. Step 1: Understand whitelist behavior

   Whitelist removes properties not in DTO silently without error.

2. Step 2: Check how to throw error on extra props

   To throw error on extra properties, forbidNonWhitelisted: true must be set.

3. Final Answer:

   The ValidationPipe should have forbidNonWhitelisted to throw error on extra props -> Option A

4. Quick Check:

   forbidNonWhitelisted throws error on extra props [OK]

Hint: Use forbidNonWhitelisted to reject extra properties with error [OK]

Common Mistakes:

• Thinking whitelist throws error by default
• Ignoring need for forbidNonWhitelisted option
• Confusing whitelist with transform option

5. You want to ensure that your NestJS API only accepts properties defined in your DTO, automatically converts input types, and throws an error if extra properties are sent. Which ValidationPipe configuration achieves this?

hard

A. new ValidationPipe({ whitelist: true, transform: true })

B. new ValidationPipe({ whitelist: true, transform: true, forbidNonWhitelisted: true })

C. new ValidationPipe({ transform: true, skipMissingProperties: true })

D. new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true })

Solution

1. Step 1: Identify needed options

   Whitelist removes extra props, transform converts types, forbidNonWhitelisted throws error on extra props.

2. Step 2: Match options to requirements

   Only new ValidationPipe({ whitelist: true, transform: true, forbidNonWhitelisted: true }) includes all three: whitelist, transform, and forbidNonWhitelisted.

3. Final Answer:

   new ValidationPipe({ whitelist: true, transform: true, forbidNonWhitelisted: true }) -> Option B

4. Quick Check:

   Whitelist + transform + forbidNonWhitelisted = strict validation [OK]

Hint: Combine whitelist, transform, forbidNonWhitelisted for strict validation [OK]

Common Mistakes:

• Omitting forbidNonWhitelisted to throw errors
• Forgetting transform for type conversion
• Using skipMissingProperties instead of forbidNonWhitelisted