Questions
16 of 29
1What is a pipe in NestJS and what are its two primary uses?
2How does ValidationPipe work with class-validator and class-transformer in NestJS?
3What is the difference between applying a pipe at the param level vs handler level vs globally in NestJS?
4How do you write a custom pipe for parsing and validating a MongoDB ObjectId param in NestJS?
5What are all the built-in pipes NestJS ships with?
6What is class-transformer and how does it complement class-validator in NestJS?
7How do you write a custom pipe that sanitizes a string input (trim and lowercase) in NestJS?
8How do you write a pipe that uses metatype to skip validation for primitive types the same way ValidationPipe does?
9What are the two ways to register a global pipe in NestJS and what is the difference?
10What are all the significant ValidationPipe options and what does each do in NestJS?
11How do you unit test a custom pipe in NestJS?
12Can a pipe be asynchronous in NestJS and how do you implement one?
13How do you write an async custom validator that checks uniqueness against a database in NestJS?
14How do you validate arrays and conditional fields with class-validator in NestJS?
15How do you use validation groups with class-validator to apply different rules for create vs update operations in NestJS?
16What does @Exclude() and @Expose() do and how do you use them to strip sensitive fields from responses?
17What is the excludeExtraneousValues option in class-transformer and how does it differ from whitelist in ValidationPipe?
18How do you make a custom pipe configurable by accepting constructor options in NestJS?
19How do you customise the error response format produced by ValidationPipe in NestJS?
20How do you handle file upload validation with ParseFilePipe and custom file validators in NestJS?
21What interface must a custom pipe implement and what does the transform() method receive?
22What is the difference between a transformation pipe and a validation pipe in NestJS?
23How do you pass options to a built-in pipe like ParseIntPipe or ParseUUIDPipe in NestJS?
24What is class-validator and how does it integrate with NestJS ValidationPipe?
25What is the @ValidateNested() decorator and when must you pair it with @Type()?
26How do you write a custom class-validator decorator in NestJS?
27What does the @Transform() decorator do in class-transformer and when should you use it?
28How does @Type() interact with discriminated unions and polymorphic DTOs in class-transformer?
29How do you write a pipe that validates and parses a date string from a route parameter in NestJS?
NestJSNestJS
Basics
Modules
Decorators
Controllers
Dependency Injection
Providers
Architecture
Request Lifecycle
Middleware
Guards
Interceptors
Pipes
Filters
Exception Handling
API Design
GraphQL
Database and ORM
Microservices
Authentication and Authorization
16 / 29

What does @Exclude() and @Expose() do and how do you use them to strip sensitive fields from responses?

Difficulty: 5/10
class-transformer decorators, DTO sanitization, response serialization

@Exclude() marks a property to be omitted during serialization. @Expose() marks a property to be included when excludeExtraneousValues: true is used — a whitelist approach. ClassSerializerInterceptor from NestJS calls instanceToPlain() on every response, applying all @Exclude() and @Expose() rules automatically.

Entity with @Exclude() and ClassSerializerInterceptor
@Exclude() and @Expose() usage rules:
  1. 1

    @Exclude() — blacklist approach: all properties included by default, decorated ones are stripped.

  2. 2

    @Expose() with excludeExtraneousValues: true — whitelist approach: only decorated properties are included.

  3. 3

    ClassSerializerInterceptor must be enabled globally for automatic serialization on every response.

  4. 4

    Return class instances from controllers, not plain objects — @Exclude() has no effect on plain objects.

  5. 5

    @Exclude({ toClassOnly: true }) — excludes only during deserialization, not serialization.

Scenario Questions

0-2 years experience

  1. 1We have a UserDto with id, email, password, and role. How would you use @Exclude and @Expose so that the password never appears in the JSON response?
  2. 2If you forget to set the global transform option excludeExtraneousValues, what will happen when you return a User entity from a controller?

2-5 years experience

  1. 1You need to add a new field 'lastLogin' to the UserDto but only expose it for admin endpoints. Walk me through how you would configure @Expose to make this conditional.
  2. 2During a code review you notice that some responses still contain the 'secretKey' property even though you added @Exclude on the entity. What could be causing this and how would you debug it?

5-8 years experience

  1. 1Our microservice serializes large payloads (hundreds of fields) and we want to enforce a strict contract across teams. How would you design a base DTO strategy using @Exclude/@Expose to guarantee only whitelisted fields are sent, and what trade‑offs does this introduce?
  2. 2We are migrating from class-validator to a custom validation layer but must keep the existing @Exclude/@Expose behavior. What architectural changes would you make to avoid breaking existing clients while improving performance?

8+ years experience

  1. 1Across several services we have inconsistent use of @Exclude/@Expose, leading to accidental data leaks. How would you lead a company‑wide refactor to standardize serialization policies, considering versioning, backward compatibility, and cross‑team coordination?
  2. 2If we decide to move from NestJS class‑transformer to a streaming JSON serializer for high‑throughput APIs, how would you preserve the field‑level exclusion semantics that @Exclude/@Expose provide?

Follow-up Questions

  • How would you handle a case where a third‑party library returns an object that still contains hidden fields?
  • What impact does enabling excludeExtraneousValues have on performance or on existing endpoints?
  • Can you combine @Exclude/@Expose with custom serialization logic, and why might you need to?
Share

Share via WhatsApp, X, Facebook, LinkedIn or copy link. Open Graph preview enabled.