Django休息框架序列化器排除不起作用

Question

所以我有以下两个序列化器：

class UserSerializer(serializers.ModelSerializer):
    class Meta:
        model = User
        exclude = ("password",)

class FooBarSerializer(serializers.ModelSerializer):

    user = UserSerializer()

    class Meta:
        model = FooBar
        fields = ("user",)

当我运行我的观点以获取FooBar信息时，它仍会显示用户密码... 为什么？

视图

class FooBar(generics.ListAPIView):

    queryset = FooBar.objects.all()
    serializer_class = FooBarSerializer