serialization is not work properly in lower levels- django-rest-framework - django

Question

my Comment model is like below:
class Comment(models.Model):
user = models.ForeignKey(User)
content = models.TextField()
parent = models.ForeignKey('self', related_name='answers')
I want to serializer comment and all of its answers. So i've wrote this serializer:
class CommentSerializer(ModelSerializer):
user = UserSerializer(fields=('get_full_name',), allow_null=True)
class Meta:
model = Comment
fields = ['user', 'content', 'answers']
depth = 10
now when I serialize a comment by this serializer, it works properly just for level 1 of the comment. the answers object shows all the data, such as user's password! or it shows 'parent' while I didn't include parent to the fields of Meta class of the serializer.
the following is the output of this serializer:
{
"data": {
"pk": 15,
"user": null,
"name": "rwqerweqr",
"email": null,
"content": "A",
"approved": false,
"created_at": "2019-03-31T23:16:44.980338+04:30",
"answers": [
{
"id": 14,
"content": "B",
"name": null,
"email": null,
"approved": false,
"created_at": "2019-03-31T23:08:13.374350+04:30",
"user": {
"id": 3,
"is_superuser": true,
"email": "email#gmail.com",
"phone": "[phone]",
"password": "pbkdf2_sha256$36000$RDdFKTXhvzhb$GaR2Y0p1DBp/5pO5yqayMmdNN/XjnoWEdKshYbmkwCk=",
"first_name": "Alex",
"last_name": "Doe",
"created_at": "2019-03-26T21:16:53.818407+04:30",
"last_login": "2019-03-26T21:17:14.987512+04:30",
"is_active": true,
"is_staff": true,
"groups": [],
"user_permissions": []
},
"parent": {
"id": 15,
"content": "A",
"name": "rwqerweqr",
"email": null,
"approved": false,
"created_at": "2019-03-31T23:16:44.980338+04:30",
"user": null,
"parent": {
"id": 13,
"content": "C",
"name": null,
"email": null,
"approved": false,
"created_at": "2019-03-31T21:27:29.152248+04:30",
"user": {
"id": 3,
"is_superuser": true,
"email": "email#gmail.com",
"phone": "[phone]",
"password": "pbkdf2_sha256$36000$RDdFKTXhvzhb$GaR2Y0p1DBp/5pO5yqayMmdNN/XjnoWEdKshYbmkwCk=",
"first_name": "Alex",
"last_name": "Doe",
"created_at": "2019-03-26T21:16:53.818407+04:30",
"last_login": "2019-03-26T21:17:14.987512+04:30",
"is_active": true,
"is_staff": true,
"groups": [],
"user_permissions": []
},
"parent": {
"id": 14,
"content": "B",
"name": null,
"email": null,
"approved": false,
"created_at": "2019-03-31T23:08:13.374350+04:30",
"user": {
"id": 3,
"is_superuser": true,
"email": "email#gmail.com",
"phone": "[phone]",
"password": "pbkdf2_sha256$36000$RDdFKTXhvzhb$GaR2Y0p1DBp/5pO5yqayMmdNN/XjnoWEdKshYbmkwCk=",
"first_name": "Alex",
"last_name": "Doe",
"created_at": "2019-03-26T21:16:53.818407+04:30",
"last_login": "2019-03-26T21:17:14.987512+04:30",
"is_active": true,
"is_staff": true,
"groups": [],
"user_permissions": []
},
"parent": {
"id": 15,
"content": "A",
"name": "rwqerweqr",
"email": null,
"approved": false,
"created_at": "2019-03-31T23:16:44.980338+04:30",
"user": null,
"parent": {
"id": 13,
"content": "C",
"name": null,
"email": null,
"approved": false,
"created_at": "2019-03-31T21:27:29.152248+04:30",
"user": {
"id": 3,
"is_superuser": true,
"email": "email#gmail.com",
"phone": "[phone]",
"password": "pbkdf2_sha256$36000$RDdFKTXhvzhb$GaR2Y0p1DBp/5pO5yqayMmdNN/XjnoWEdKshYbmkwCk=",
"first_name": "Alex",
"last_name": "Doe",
"created_at": "2019-03-26T21:16:53.818407+04:30",
"last_login": "2019-03-26T21:17:14.987512+04:30",
"is_active": true,
"is_staff": true,
"groups": [],
"user_permissions": []
},
"parent": {
"id": 14,
"content": "B",
"name": null,
"email": null,
"approved": false,
"created_at": "2019-03-31T23:08:13.374350+04:30",
"user": {
"id": 3,
"is_superuser": true,
"email": "email#gmail.com",
"phone": "[phone]",
"password": "pbkdf2_sha256$36000$RDdFKTXhvzhb$GaR2Y0p1DBp/5pO5yqayMmdNN/XjnoWEdKshYbmkwCk=",
"first_name": "Alex",
"last_name": "Doe",
"created_at": "2019-03-26T21:16:53.818407+04:30",
"last_login": "2019-03-26T21:17:14.987512+04:30",
"is_active": true,
"is_staff": true,
"groups": [],
"user_permissions": []
},
"parent": {
"id": 15,
"content": "A",
"name": "rwqerweqr",
"email": null,
"approved": false,
"created_at": "2019-03-31T23:16:44.980338+04:30",
"user": null,
"parent": {
"id": 13,
"content": "C",
"name": null,
"email": null,
"approved": false,
"created_at": "2019-03-31T21:27:29.152248+04:30",
"user": {
"id": 3,
"is_superuser": true,
"email": "email#gmail.com",
"phone": "[phone]",
"password": "pbkdf2_sha256$36000$RDdFKTXhvzhb$GaR2Y0p1DBp/5pO5yqayMmdNN/XjnoWEdKshYbmkwCk=",
"first_name": "Alex",
"last_name": "Doe",
"created_at": "2019-03-26T21:16:53.818407+04:30",
"last_login": "2019-03-26T21:17:14.987512+04:30",
"is_active": true,
"is_staff": true,
"groups": [],
"user_permissions": []
},
"parent": {
"id": 14,
"content": "B",
"name": null,
"email": null,
"approved": false,
"created_at": "2019-03-31T23:08:13.374350+04:30",
"user": 3,
"parent": 15
}
}
}
}
}
}
}
}
}
},
{
"id": 16,
"content": "D",
"name": "werwer",
"email": null,
"approved": false,
"created_at": "2019-04-01T18:37:46.981327+04:30",
"user": null,
"parent": {
"id": 15,
"content": "A",
"name": "rwqerweqr",
"email": null,
"approved": false,
"created_at": "2019-03-31T23:16:44.980338+04:30",
"user": null,
"parent": {
"id": 13,
"content": "C",
"name": null,
"email": null,
"approved": false,
"created_at": "2019-03-31T21:27:29.152248+04:30",
"user": {
"id": 3,
"is_superuser": true,
"email": "email#gmail.com",
"phone": "[phone]",
"password": "pbkdf2_sha256$36000$RDdFKTXhvzhb$GaR2Y0p1DBp/5pO5yqayMmdNN/XjnoWEdKshYbmkwCk=",
"first_name": "Alex",
"last_name": "Doe",
"created_at": "2019-03-26T21:16:53.818407+04:30",
"last_login": "2019-03-26T21:17:14.987512+04:30",
"is_active": true,
"is_staff": true,
"groups": [],
"user_permissions": []
},
"parent": {
"id": 14,
"content": "B",
"name": null,
"email": null,
"approved": false,
"created_at": "2019-03-31T23:08:13.374350+04:30",
"user": {
"id": 3,
"is_superuser": true,
"email": "email#gmail.com",
"phone": "[phone]",
"password": "pbkdf2_sha256$36000$RDdFKTXhvzhb$GaR2Y0p1DBp/5pO5yqayMmdNN/XjnoWEdKshYbmkwCk=",
"first_name": "Alex",
"last_name": "Doe",
"created_at": "2019-03-26T21:16:53.818407+04:30",
"last_login": "2019-03-26T21:17:14.987512+04:30",
"is_active": true,
"is_staff": true,
"groups": [],
"user_permissions": []
},
"parent": {
"id": 15,
"content": "A",
"name": "rwqerweqr",
"email": null,
"approved": false,
"created_at": "2019-03-31T23:16:44.980338+04:30",
"user": null,
"parent": {
"id": 13,
"content": "C",
"name": null,
"email": null,
"approved": false,
"created_at": "2019-03-31T21:27:29.152248+04:30",
"user": {
"id": 3,
"is_superuser": true,
"email": "email#gmail.com",
"phone": "[phone]",
"password": "pbkdf2_sha256$36000$RDdFKTXhvzhb$GaR2Y0p1DBp/5pO5yqayMmdNN/XjnoWEdKshYbmkwCk=",
"first_name": "Alex",
"last_name": "Doe",
"created_at": "2019-03-26T21:16:53.818407+04:30",
"last_login": "2019-03-26T21:17:14.987512+04:30",
"is_active": true,
"is_staff": true,
"groups": [],
"user_permissions": []
},
"parent": {
"id": 14,
"content": "B",
"name": null,
"email": null,
"approved": false,
"created_at": "2019-03-31T23:08:13.374350+04:30",
"user": {
"id": 3,
"is_superuser": true,
"email": "email#gmail.com",
"phone": "[phone]",
"password": "pbkdf2_sha256$36000$RDdFKTXhvzhb$GaR2Y0p1DBp/5pO5yqayMmdNN/XjnoWEdKshYbmkwCk=",
"first_name": "Alex",
"last_name": "Doe",
"created_at": "2019-03-26T21:16:53.818407+04:30",
"last_login": "2019-03-26T21:17:14.987512+04:30",
"is_active": true,
"is_staff": true,
"groups": [],
"user_permissions": []
},
"parent": {
"id": 15,
"content": "A",
"name": "rwqerweqr",
"email": null,
"approved": false,
"created_at": "2019-03-31T23:16:44.980338+04:30",
"user": null,
"parent": {
"id": 13,
"content": "C",
"name": null,
"email": null,
"approved": false,
"created_at": "2019-03-31T21:27:29.152248+04:30",
"user": {
"id": 3,
"is_superuser": true,
"email": "email#gmail.com",
"phone": "[phone]",
"password": "pbkdf2_sha256$36000$RDdFKTXhvzhb$GaR2Y0p1DBp/5pO5yqayMmdNN/XjnoWEdKshYbmkwCk=",
"first_name": "Alex",
"last_name": "Doe",
"created_at": "2019-03-26T21:16:53.818407+04:30",
"last_login": "2019-03-26T21:17:14.987512+04:30",
"is_active": true,
"is_staff": true,
"groups": [],
"user_permissions": []
},
"parent": {
"id": 14,
"content": "B",
"name": null,
"email": null,
"approved": false,
"created_at": "2019-03-31T23:08:13.374350+04:30",
"user": 3,
"parent": 15
}
}
}
}
}
}
}
}
}
}
]
}
}
as you see, in the answers object, it shows user's data completely, include of its hashed password or permissions.
or it shows parent field while it is not in the serializer at all!.
how to solve this problem?
thanks.
UPDATE
usecase: Comments B and D are answers of comment A. (b.parent == A)

Answer 1

As displayed in django-rest-framework docs:
The depth option should be set to an integer value that indicates the depth of relationships that should be traversed before reverting to a flat representation.
If you want to customize the way the serialization is done you'll need to define the field yourself.
You should serialize the answers field, in order to hide those informations. I would follow the approach of SerializerMethodField. I will write an example:
class CommentSerializer(ModelSerializer):
user = UserSerializer(fields=('get_full_name',), allow_null=True)
answers = serializers.SerializerMethodField()
class Meta:
model = Comment
fields = ['user', 'content', 'answers']
def get_answers(self, instance):
# Here you will create your custom serialization