What is the excludeExtraneousValues option in class-transformer and how does it differ from whitelist in ValidationPipe?

Q: What is the excludeExtraneousValues option in class-transformer and how does it differ from whitelist in ValidationPipe?

// ValidationPipe whitelist — strips unknown REQUEST input properties app.useGlobalPipes(new ValidationPipe({ whitelist: true })); // POST body { name: 'Alice', hacker: 'injection' } -> { name: 'Alice' } // 'hacker' is silently stripped before reaching the handler // excludeExtraneousValues — only keep @Expose() properties in RESPONSE const plain = plainToInstance(UserDto, user, { excludeExtraneousValues: true, // strips anything without @Expose() }); export class UserDto { @Expose() id: number; @Expose() email: string; password: string; // no @Expose() -> stripped from output } ValidationPipe whitelist — runs during deserialization (JSON to DTO); strips unknown input. excludeExtraneousValues — runs during serialization (class to plain); strips unexposed output. whitelist does not require @Expose() on DTO properties — it uses the declared class shape. excludeExtraneousValues requires every included property to have @Expose() explicitly. Use both together for full control: whitelist on input, excludeExtraneousValues on output.

Difficulty: 5/10

class-transformer, ValidationPipe, NestJS DTO handling

Both strip unknown properties but they operate at different stages and in opposite directions. ValidationPipe whitelist strips unknown properties from the incoming request body during deserialization. excludeExtraneousValues strips properties without @Expose() from the result during serialization. One filters input, the other filters output.

whitelist vs excludeExtraneousValues comparison

Key differences:

1
ValidationPipe whitelist — runs during deserialization (JSON to DTO); strips unknown input.
2
excludeExtraneousValues — runs during serialization (class to plain); strips unexposed output.
3

What is the excludeExtraneousValues option in class-transformer and how does it differ from whitelist in ValidationPipe?

Difficulty: 5/10

class-transformer, ValidationPipe, NestJS DTO handling

Both strip unknown properties but they operate at different stages and in opposite directions. ValidationPipe whitelist strips unknown properties from the incoming request body during deserialization. excludeExtraneousValues strips properties without @Expose() from the result during serialization. One filters input, the other filters output.

whitelist vs excludeExtraneousValues comparison

Key differences:

1
ValidationPipe whitelist — runs during deserialization (JSON to DTO); strips unknown input.
2
excludeExtraneousValues — runs during serialization (class to plain); strips unexposed output.
3

What is the excludeExtraneousValues option in class-transformer and how does it differ from whitelist in ValidationPipe?

What is the excludeExtraneousValues option in class-transformer and how does it differ from whitelist in ValidationPipe?

Scenario Questions

Follow-up Questions