Why DTO pattern for data transfer in Spring Boot? - Purpose & Use Cases

The Big Idea

Discover how a simple object can protect your app and speed up data flow!

The Scenario

Imagine building a web app where you send full database objects directly to the user interface every time someone requests data.

For example, sending a whole user record including password hashes and internal IDs to the frontend.

The Problem

Manually sending full objects is risky and slow.

It exposes sensitive data, wastes bandwidth, and makes your app harder to maintain.

Changing your database means changing all parts that use those objects.

The Solution

The DTO pattern creates simple, tailored objects just for data transfer.

It hides sensitive info and sends only what the client needs.

This keeps your app safe, fast, and easier to update.

Before vs After

✗ Before

return userRepository.findById(id);

✓ After

User user = userRepository.findById(id).orElse(null);
return new UserDTO(user.getName(), user.getEmail());

What It Enables

DTOs let you control exactly what data moves between layers, improving security and flexibility.

Real Life Example

When a user profile loads, you send only their display name and avatar URL, not their password or internal notes.

Key Takeaways

Sending full database objects exposes sensitive data and wastes resources.

DTOs create simple, safe objects for data transfer only.

This pattern improves security, performance, and code maintainability.

Practice

1. What is the main purpose of using a DTO (Data Transfer Object) in a Spring Boot application?

easy

A. To manage application configuration settings

B. To store data permanently in the database

C. To handle user authentication and authorization

D. To safely transfer only necessary data between different parts of the application

Solution

1. Step 1: Understand the role of DTOs

   DTOs are simple objects designed to carry data between layers or parts of an application without exposing sensitive or unnecessary details.

2. Step 2: Identify the correct purpose

   Unlike entities or configuration classes, DTOs focus on safe and clean data transfer, not storage or security management.

3. Final Answer:

   To safely transfer only necessary data between different parts of the application -> Option D

4. Quick Check:

   DTO purpose = safe data transfer [OK]

Hint: DTOs move data safely without exposing all details [OK]

Common Mistakes:

• Confusing DTOs with database entities
• Thinking DTOs handle security
• Assuming DTOs store data permanently

2. Which of the following is the correct way to define a simple DTO class in Spring Boot using Java records?

easy

A. public record UserDTO(String name, String email) {}

B. public class UserDTO { private String name; private String email; }

C. public interface UserDTO { String getName(); String getEmail(); }

D. public enum UserDTO { NAME, EMAIL }

Solution

1. Step 1: Recognize Java record syntax

   Java records provide a concise way to create immutable data carriers with automatic getters and constructors.

2. Step 2: Match the correct syntax

   public record UserDTO(String name, String email) {} uses the correct record declaration with fields inside parentheses and empty body braces.

3. Final Answer:

   public record UserDTO(String name, String email) {} -> Option A

4. Quick Check:

   Java record syntax = public record UserDTO(String name, String email) {} [OK]

Hint: Java records use 'record Name(fields) {}' syntax [OK]

Common Mistakes:

• Using class without constructors/getters
• Confusing interface with DTO class
• Using enum for data transfer

3. Given this Spring Boot code snippet, what will be the output when the getUserDTO() method is called?

public record UserDTO(String name, int age) {}

public UserDTO getUserDTO() {
    UserDTO user = new UserDTO("Alice", 30);
    return new UserDTO(user.name(), user.age() + 5);
}

medium

A. UserDTO[name=Alice, age=5]

B. UserDTO[name=Alice, age=35]

C. UserDTO[name=Alice, age=30]

D. Compilation error due to missing constructor

Solution

1. Step 1: Understand record instantiation and methods

   The record UserDTO has fields name and age with automatic accessor methods name() and age().

2. Step 2: Analyze the returned object

   The method creates a UserDTO with name "Alice" and age 30, then returns a new UserDTO with the same name and age increased by 5 (30 + 5 = 35).

3. Final Answer:

   UserDTO[name=Alice, age=35] -> Option B

4. Quick Check:

   Age incremented by 5 = 35 [OK]

Hint: Records have automatic getters like name() and age() [OK]

Common Mistakes:

• Forgetting to add 5 to age
• Confusing method calls with field access
• Assuming default toString format

4. Identify the error in this DTO usage code snippet:

public record ProductDTO(String name, double price) {}

public ProductDTO createProduct() {
    ProductDTO product = new ProductDTO("Book");
    return product;
}

medium

A. Missing second argument for price in ProductDTO constructor

B. Records cannot be used as DTOs

C. Method createProduct should return void

D. ProductDTO fields must be private

Solution

1. Step 1: Check record constructor parameters

   The ProductDTO record requires two parameters: a String name and a double price.

2. Step 2: Identify constructor call mistake

   The constructor call provides only one argument "Book", missing the price argument, causing a compile-time error.

3. Final Answer:

   Missing second argument for price in ProductDTO constructor -> Option A

4. Quick Check:

   Constructor args must match record fields [OK]

Hint: Record constructors need all fields in order [OK]

Common Mistakes:

• Passing fewer arguments than fields
• Thinking records can't be DTOs
• Ignoring method return types

5. You want to create a DTO that hides the user's password when sending data to the client. Given the entity:

public class User {
    private String username;
    private String password;
    private String email;
    // getters and setters
}

Which DTO definition best achieves this goal?

hard

A. public class UserDTO { private String password; }

B. public record UserDTO(String username, String password, String email) {}

C. public record UserDTO(String username, String email) {}

D. public record UserDTO(String password) {}

Solution

1. Step 1: Understand the goal to hide password

   The DTO should exclude the password field to avoid exposing it to clients.

2. Step 2: Choose DTO fields accordingly

   public record UserDTO(String username, String email) {} includes only username and email, omitting password, which meets the requirement.

3. Final Answer:

   public record UserDTO(String username, String email) {} -> Option C

4. Quick Check:

   Exclude sensitive fields in DTO [OK]

Hint: Exclude sensitive fields from DTO to hide them [OK]

Common Mistakes:

• Including password in DTO fields
• Using DTO with only password
• Confusing entity with DTO