What does @Exclude() and @Expose() do and how do you use them to strip sensitive fields from responses?

Q: What does @Exclude() and @Expose() do and how do you use them to strip sensitive fields from responses?

import { Exclude, Expose } from 'class-transformer'; export class UserEntity { @Expose() id: number; @Expose() email: string; @Exclude() password: string; // never sent to client @Exclude() refreshToken: string; // never sent to client constructor(partial: Partial ) { Object.assign(this, partial); } } // Controller — return UserEntity instance, not a plain object @Get(':id') async findOne(@Param('id', ParseIntPipe) id: number): Promise { return new UserEntity(await this.usersService.findOne(id)); } // Enable globally — ClassSerializerInterceptor calls instanceToPlain() on responses app.useGlobalInterceptors(new ClassSerializerInterceptor(app.get(Reflector))); @Exclude() — blacklist approach: all properties included by default, decorated ones are stripped. @Expose() with excludeExtraneousValues: true — whitelist approach: only decorated properties are included. ClassSerializerInterceptor must be enabled globally for automatic serialization on every response. Return class instances from controllers, not plain objects — @Exclude() has no effect on plain objects. @Exclude({ toClassOnly: true }) — excludes only during deserialization, not serialization.

Difficulty: 5/10

class-transformer decorators, DTO sanitization, response serialization

@Exclude() marks a property to be omitted during serialization. @Expose() marks a property to be included when excludeExtraneousValues: true is used — a whitelist approach. ClassSerializerInterceptor from NestJS calls instanceToPlain() on every response, applying all @Exclude() and @Expose() rules automatically.

Entity with @Exclude() and ClassSerializerInterceptor

@Exclude() and @Expose() usage rules:

1
@Exclude() — blacklist approach: all properties included by default, decorated ones are stripped.
2
@Expose() with excludeExtraneousValues: true — whitelist approach: only decorated properties are included.

What does @Exclude() and @Expose() do and how do you use them to strip sensitive fields from responses?

Difficulty: 5/10

class-transformer decorators, DTO sanitization, response serialization

@Exclude() marks a property to be omitted during serialization. @Expose() marks a property to be included when excludeExtraneousValues: true is used — a whitelist approach. ClassSerializerInterceptor from NestJS calls instanceToPlain() on every response, applying all @Exclude() and @Expose() rules automatically.

Entity with @Exclude() and ClassSerializerInterceptor

@Exclude() and @Expose() usage rules:

1
@Exclude() — blacklist approach: all properties included by default, decorated ones are stripped.
2
@Expose() with excludeExtraneousValues: true — whitelist approach: only decorated properties are included.

What does @Exclude() and @Expose() do and how do you use them to strip sensitive fields from responses?

What does @Exclude() and @Expose() do and how do you use them to strip sensitive fields from responses?

Scenario Questions

Follow-up Questions