python - Django rest framework serializer exclude not working -

so have following 2 serializers:

class userserializer(serializers.modelserializer):     class meta:         model = user         exclude = ("password",)  class foobarserializer(serializers.modelserializer):      user = userserializer()      class meta:         model = foobar         fields = ("user",) 

when run view foobar info, still displays users password...why?

the view

class foobar(generics.listapiview):      queryset = foobar.objects.all()     serializer_class = foobarserializer