CodePark/ questions / Pipes, DTOs & validation
START PRACTICINGPRACTICE
Backend question · NestJS › Pipes, DTOs & validation

With new ValidationPipe({ whitelist: true }) and the DTO below, a client sends { "name": "Tom", "isAdmin": true }. What does the handler receive?

export class UpdateProfileDto {
  @IsString()
  name: string;
}
{ name: "Tom" }

The handler receives { name: "Tom" }. whitelist silently removes properties that have no validation decorator. So isAdmin is removed and the request succeeds.

"Nothing: the request fails with 400 because isAdmin is not allowed" is wrong here. A 400 for unknown properties only happens if you also set forbidNonWhitelisted: true.