Response DTO for output in Spring Boot - Step-by-Step Execution

Concept Flow - Response DTO for output

Client sends request

↓

Controller receives request

↓

Controller calls Service

↓

Service prepares Response DTO

↓

Controller returns Response DTO

↓

Client receives JSON output

Shows how a Spring Boot controller uses a Response DTO to send structured output back to the client.

Execution Sample

Spring Boot

public record UserResponseDTO(Long id, String name, String email) {}

@GetMapping("/user/{id}")
public UserResponseDTO getUser(@PathVariable Long id) {
    User user = userService.findById(id);
    return new UserResponseDTO(user.getId(), user.getName(), user.getEmail());
}

A Spring Boot controller method returns a UserResponseDTO as JSON output for a user request.

Execution Table

Step	Action	Input/State	Output/Result
1	Client sends GET /user/5	Request: /user/5	Request received by Controller
2	Controller calls userService.findById(5)	id=5	User object with id=5, name='Alice', email='[e-mail]'
3	Controller creates UserResponseDTO	User data	UserResponseDTO(id=5, name='Alice', email='[e-mail]')
4	Controller returns UserResponseDTO	UserResponseDTO	JSON response sent to client
5	Client receives JSON	JSON: {"id":5,"name":"Alice","email":"[e-mail]"}	Client displays or processes data
6	End	No more actions	Response cycle complete

💡 Response DTO sent as JSON and client receives it, ending the request-response cycle.

Variable Tracker

Variable	Start	After Step 2	After Step 3	Final
id	null	5	5	5
user	null	User(id=5, name='Alice', email='[e-mail]')	User(id=5, name='Alice', email='[e-mail]')	User(id=5, name='Alice', email='[e-mail]')
responseDTO	null	null	UserResponseDTO(id=5, name='Alice', email='[e-mail]')	UserResponseDTO(id=5, name='Alice', email='[e-mail]')

Key Moments - 2 Insights

Why do we use a Response DTO instead of returning the User entity directly?

The Response DTO controls exactly what data is sent to the client, avoiding exposing sensitive or unnecessary fields. See step 3 in execution_table where only selected fields are included.

What happens if the userService.findById returns null?

If null is returned, the controller should handle it (e.g., return 404). This example assumes a valid user is found as shown in step 2.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of 'responseDTO' after step 3?

A null

B User entity

C UserResponseDTO with user data

D JSON string

💡 Hint

Check the variable_tracker row for 'responseDTO' after step 3.

At which step does the controller send the JSON response to the client?

A Step 4

B Step 3

C Step 2

D Step 5

💡 Hint

Look at the 'Output/Result' column in execution_table for when JSON is sent.

If the userService returned a user with an extra field 'password', would it appear in the JSON response?

A Yes, all user fields are included

B No, only fields in Response DTO are included

C Only if annotated with @JsonInclude

D Only if controller manually adds it

💡 Hint

Response DTO defines exactly which fields are sent, see step 3 and variable_tracker.

Concept Snapshot

Response DTO in Spring Boot:
- A simple class or record holding output data
- Controller returns DTO, not entity
- Spring converts DTO to JSON automatically
- Controls data sent to client
- Helps keep API clean and secure

Full Transcript

This visual execution shows how a Spring Boot controller handles a client request by returning a Response DTO. The client sends a GET request for a user. The controller calls a service to get the user entity. Then it creates a Response DTO with selected user fields. The controller returns this DTO, which Spring converts to JSON and sends to the client. The client receives the JSON and can use it. Variables like 'id', 'user', and 'responseDTO' change as the code runs. Key points include why to use a DTO and what happens if no user is found. The quizzes check understanding of variable states and response timing.

Practice

1. What is the main purpose of using a Response DTO in a Spring Boot application?

easy

A. To handle incoming HTTP requests

B. To define the exact data structure sent back to the client

C. To store data in the database

D. To configure application properties

Solution

1. Step 1: Understand the role of Response DTO

   A Response DTO is used to shape the data sent back to the client, controlling what fields are exposed.

2. Step 2: Differentiate from other components

   It is not used for storing data or handling requests, but specifically for output formatting.

3. Final Answer:

   To define the exact data structure sent back to the client -> Option B

4. Quick Check:

   Response DTO = Output data structure [OK]

Hint: Response DTO controls output data format [OK]

Common Mistakes:

• Confusing Response DTO with entity or request DTO
• Thinking Response DTO handles input data
• Assuming Response DTO manages database operations

2. Which of the following is the correct way to define a simple Response DTO class in Spring Boot?

easy

A. public record UserResponse(String name) {}

B. public class UserResponse { private String name; public String getName() { return name; } }

C. public enum UserResponse { NAME; }

D. public interface UserResponse { String name; }

Solution

1. Step 1: Identify valid Java class for DTO

   Spring Boot supports Java records as concise DTOs with immutable fields and automatic getters.

2. Step 2: Check syntax correctness

   public record UserResponse(String name) {} uses a record with a field and no boilerplate code, which is modern and valid.

3. Final Answer:

   public record UserResponse(String name) {} -> Option A

4. Quick Check:

   Use record for simple immutable DTO [OK]

Hint: Use Java record for simple DTOs [OK]

Common Mistakes:

• Using interface instead of class or record
• Using enum for data container
• Omitting getters in POJO classes

3. Given this Response DTO and controller method, what JSON will be returned?

public record ProductResponse(String name, double price) {}

@GetMapping("/product")
public ProductResponse getProduct() {
  return new ProductResponse("Book", 12.5);
}

medium

A. {"name":"Book"}

B. {"productName":"Book","productPrice":12.5}

C. {"name":"Book","price":12.5}

D. {"name":"Book","price":"12.5"}

Solution

1. Step 1: Understand record fields and JSON mapping

   The record fields are name and price, which map directly to JSON keys.

2. Step 2: Check returned JSON structure

   The returned JSON includes both fields with correct types: string for name and number for price.

3. Final Answer:

   {"name":"Book","price":12.5} -> Option C

4. Quick Check:

   Record fields map directly to JSON keys [OK]

Hint: Record fields become JSON keys as-is [OK]

Common Mistakes:

• Assuming JSON keys change names automatically
• Treating numbers as strings in JSON
• Missing fields in output JSON

4. What is wrong with this Response DTO class?

public class UserResponse {
  private String username;
  public UserResponse(String username) {}
  public String getUsername() { return username; }
}

medium

A. Class should be abstract

B. Getter method is missing

C. Field username should be public

D. Constructor does not assign the username field

Solution

1. Step 1: Check constructor implementation

   The constructor has a parameter but does not assign it to the field, so username remains null.

2. Step 2: Verify getter correctness

   The getter returns the field value, but since field is never set, it returns null.

3. Final Answer:

   Constructor does not assign the username field -> Option D

4. Quick Check:

   Constructor must set fields [OK]

Hint: Always assign constructor params to fields [OK]

Common Mistakes:

• Forgetting to assign constructor parameters
• Making fields public unnecessarily
• Thinking getters alone set values

5. You want to create a Response DTO that only exposes a user's id and email, hiding the password. Which approach is best in Spring Boot?

hard

A. Create a separate Response DTO class with only id and email fields

B. Return the User entity directly and ignore the password field

C. Use @JsonIgnore on the password field in the User entity

D. Send the entire User entity and filter password on the client side

Solution

1. Step 1: Understand security and data exposure

   Exposing only needed fields via a Response DTO prevents accidental leaks of sensitive data like passwords.

2. Step 2: Evaluate options for hiding password

   Creating a separate DTO with only safe fields is best practice; relying on @JsonIgnore or client filtering is less secure or less clear.

3. Final Answer:

   Create a separate Response DTO class with only id and email fields -> Option A

4. Quick Check:

   Separate DTOs protect sensitive data [OK]

Hint: Use dedicated DTOs to expose only safe fields [OK]

Common Mistakes:

• Returning entity directly exposing sensitive data
• Relying on client-side filtering for security
• Misusing @JsonIgnore without DTO separation