--- title: Day 5/30 — Validate at the Door | daily.dev description: A short tip on setting up global input validation in NestJS using ValidationPipe with whitelist, forbidNonWhitelisted, and transform options. The pattern... canonical: https://daily.dev/posts/day-5-30-validate-at-the-door-mk7mbijtu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Day 5/30 — Validate at the Door | daily.dev og:description: A short tip on setting up global input validation in NestJS using ValidationPipe with whitelist, forbidNonWhitelisted, and transform options. The pattern... og:url: https://daily.dev/posts/day-5-30-validate-at-the-door-mk7mbijtu og:image: https://api.daily.dev/og/posts/MK7MBIjTu.png og:image:alt: Day 5/30 — Validate at the Door og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Day 5/30 — Validate at the Door **[Nestjs Developers](https://daily.dev/sources/nestjsdevs)** · [@ezilemdodana](https://daily.dev/ezilemdodana) · 1 min read · 19 upvotes · 8 comments ## Summary A short tip on setting up global input validation in NestJS using ValidationPipe with whitelist, forbidNonWhitelisted, and transform options. The pattern enforces that invalid or unexpected data is rejected at the boundary before reaching business logic, keeping services clean of defensive checks. DTOs define the expected shape, validation rejects bad input, and transformation ensures handlers receive correct types. ## Content Invalid data should fail before it reaches your business logic. My preferred global setup: ``` app.useGlobalPipes( new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true, transform: true, }), ); ``` DTOs define the expected shape. Validation rejects bad input. Transformation gives handlers the correct types. Without boundary validation, every service becomes full of defensive checks. Do you reject unknown properties or silently remove them? #NestJS #Validation #APISecurity ## Community discussion Top comments from developers on daily.dev. **@agustinbarrientos** · 3 upvotes > Reject unknown properties. Silently dropping them hides typos. **@irshadjan** · 2 upvotes > My first thing to do before writing the business logic. **@arlangalvez21** · 1 upvotes > Never trust incoming data, even if it comes from a truthful source. Never! **@florantepascual** · 1 upvotes > If the DTO doesn't declare it, it doesn't exist. **@sumitchaurasiyaft** · 1 upvotes > Correct, data from the client must never be trusted. ## Similar posts on daily.dev - [Express Validator - Part 1: Why Your API Should Never Trust Client Input](https://daily.dev/posts/express-validator---part-1-why-your-api-should-never-trust-client-input-cnibyjrnd) · Medium · 1 upvotes · 0 comments - [Harden a public form endpoint](https://daily.dev/posts/harden-a-public-form-endpoint-9blksww2a) · Flavio Copes · 0 upvotes · 0 comments - [Express-Validator in Express.js: From Messy Controllers to Clean APIs.](https://daily.dev/posts/express-validator-in-express-js-from-messy-controllers-to-clean-apis--fxe66zn6k) · Medium · 3 upvotes · 0 comments - [How to Build Secure-by-Default Node.js APIs](https://daily.dev/posts/how-to-build-secure-by-default-node-js-apis-kgzyotifm) · freeCodeCamp · 10 upvotes · 0 comments - [Protect Your Entities with Domain Validation](https://daily.dev/posts/protect-your-entities-with-domain-validation-rha9t8ic8) · Telerik · 3 upvotes · 0 comments --- Tags: [#architecture](https://daily.dev/tags/architecture), [#typescript](https://daily.dev/tags/typescript), [#nestjs](https://daily.dev/tags/nestjs) [View this post on daily.dev](https://daily.dev/posts/day-5-30-validate-at-the-door-mk7mbijtu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/day-5-30-validate-at-the-door-mk7mbijtu","headline":"Day 5/30 — Validate at the Door","text":"A short tip on setting up global input validation in NestJS using ValidationPipe with whitelist, forbidNonWhitelisted, and transform options. The pattern enforces that invalid or unexpected data is rejected at the boundary before reaching business logic, keeping services clean of defensive checks. DTOs define the expected shape, validation rejects bad input, and transformation ensures handlers receive correct types.","url":"https://daily.dev/posts/day-5-30-validate-at-the-door-mk7mbijtu","datePublished":"2026-08-01T08:02:43.136Z","dateModified":"2026-09-13T21:15:18.924Z","author":{"@type":"Person","name":"Ezile Mdodana","url":"https://daily.dev/ezilemdodana","image":"https://media.daily.dev/image/upload/s--1OI8gwnO--/f_auto/v1771923757/avatars/avatar_7vB9SeLRKhOHGnzEpmFvQ?_a=BAMAMiiu0","description":"Software Project Lead sharing practical insights on NestJS, Angular, AWS and scalable systems.","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":8430}},"image":"https://media.daily.dev/image/upload/s--dmSGIpAL--/f_auto/v1785571365/posts/MK7MBIjTu?_a=BAMAMicg0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":19},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":8}],"comment":[{"@type":"Comment","text":"Reject unknown properties. Silently dropping them hides typos.","datePublished":"2026-08-01T17:12:49.620Z","url":"https://daily.dev/posts/MK7MBIjTu#c-vfUBK0xcl","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3}},{"@type":"Comment","text":"My first thing to do before writing the business logic.","datePublished":"2026-08-01T18:27:38.473Z","url":"https://daily.dev/posts/MK7MBIjTu#c-OPeW16h2L","author":{"@type":"Person","name":"Irshad Jan","url":"https://daily.dev/irshadjan","image":"https://lh3.googleusercontent.com/a/ACg8ocIbPdAoUYjuyX21TqDR5ZJH-PquRiZrqMLMi8gmArMG24c4Tmw=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"Never trust incoming data, even if it comes from a truthful source. Never!","datePublished":"2026-08-03T15:06:02.621Z","url":"https://daily.dev/posts/MK7MBIjTu#c-FI6INr1qF","author":{"@type":"Person","name":"Arlan Galvez","url":"https://daily.dev/arlangalvez21","image":"https://lh3.googleusercontent.com/a/ACg8ocJUS7uJkW5cquK3R9j4Blo6PpRTJpZSd-05hU6KLbMr6w=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"If the DTO doesn’t declare it, it doesn’t exist.","datePublished":"2026-08-03T15:31:59.859Z","url":"https://daily.dev/posts/MK7MBIjTu#c-IGiwG2rNk","author":{"@type":"Person","name":"Florante Pascual","url":"https://daily.dev/florantepascual","image":"https://lh3.googleusercontent.com/a/ACg8ocLzR-sMD_mYQ92lFaJqei9PKDr76srrWk9GrANOPoscbOMFnQ=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"Correct, data from the client must never be trusted.","datePublished":"2026-08-03T04:57:53.796Z","url":"https://daily.dev/posts/MK7MBIjTu#c-vJ2sV7sZ3","author":{"@type":"Person","name":"Sumit Chaurasiya","url":"https://daily.dev/sumitchaurasiyaft","image":"https://lh3.googleusercontent.com/a/ACg8ocK3ENbM2ym231_11jENuw_RqnsaOXUJatlZ5cjxO-V8vOPx1g=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/nestjsdevs","name":"Nestjs Developers"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Nestjs Developers","item":"https://daily.dev/squads/nestjsdevs"},{"@type":"ListItem","position":3,"name":"Day 5/30 — Validate at the Door"}]} ```