NestJS · Middle · Question 22 of 75

What is a risk of using database entities directly as request DTOs?

1Entities can't be validated
✓Correct answer: Clients can set fields they shouldn't (mass assignment), like role or balance, and the API becomes coupled to the schema
3Entities make requests slower

Explanation

Separate input DTOs list only the allowed fields. Response DTOs control what leaves the API.

Further reading

Test yourself

Take the NestJS · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.