Raise validation when the field is not mapped

[davinogueiradev]

What's a better way to validate fields in a restricted mode like this:

class DummySerializer(serializers.Serializer):
    foo = serializers.CharField()

DummySerializer(data={"foo": "bar"}).is_valid(raise_exception=True) # is valid, not raise exception
DummySerializer(data={"foo": "bar", "bar": "foo"}).is_valid(raise_exception=True) # raise exception, because bar is not in fields

[Pavel-Shcherbo]

You can reject unknown input keys in to_internal_value() before DRF filters the data down to declared fields. For JSON objects, a reusable base serializer can look like this:

from collections.abc import Mapping

from rest_framework import serializers
from rest_framework.exceptions import ErrorDetail


class StrictInputSerializer(serializers.Serializer):
    def to_internal_value(self, data):
        if isinstance(data, Mapping):
            unknown = set(data) - set(self.fields)
            if unknown:
                raise serializers.ValidationError({
                    name: [ErrorDetail("Unknown field.", code="unknown_field")]
                    for name in unknown
                })
        return super().to_internal_value(data)


class DummySerializer(StrictInputSerializer):
    foo = serializers.CharField()


assert DummySerializer(data={"foo": "bar"}).is_valid()
invalid = DummySerializer(data={"foo": "bar", "bar": "foo"})
assert not invalid.is_valid()
assert invalid.errors["bar"][0].code == "unknown_field"

Checking against self.fields uses the public input field names, including fields declared with a different source. Missing required fields, ordinary field validation and partial=True still go through DRF's normal implementation when there are no unknown keys. The mapping guard lets DRF produce its usual error for a list or other non-object input.

A few boundaries matter:

• This is fail-fast: if unknown keys exist, they are reported first; later required/field errors are not combined into that response.
• Nested serializers must inherit the strict base too if their own input should be checked. Free-form DictField content remains free-form.
• A declared read_only field is still a known field here. DRF continues to ignore that input; this example rejects unknown names, not all non-writable input.

Checked the exact example plus partial, nested and many=True cases, source aliases and normal error paths with DRF 3.16.1, Django 6.0.10 and Python 3.14.6. These are isolated serializer checks, not a full Django compatibility matrix or nested HTML-form parsing test.

Reference: overriding to_internal_value.