NestJS · Junior · Question 55 of 75

Why should password hashes never be returned in API responses?

1Hashes can't be serialized
✓Correct answer: Hashes are sensitive and help offline cracking; exclude them, e.g. with @Exclude() and ClassSerializerInterceptor
3Hashes are too long for JSON

Explanation

Returning entities directly is risky. Map to response DTOs or use serialization rules.

Further reading

Test yourself

Take the NestJS · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.