Should DTO and Entity both have input validations

Question

I have a WCF layer and my Domain Model is behind this WCF layer. I am using Nhibernate as an ORM tool and all my business logic/ Data Access etc will be behind this WCF layer.

Answer 1

Should i create DTOs? is there any harm in exposing entities directly to wcf clients

1. You should create DTOs. When entities are exposed though DataContract, WCF creates these entities from any garbage that client can possibly send to the server. It is bad practice to create entities with invalid / inconsistent state even if you plan validating the state later.

If i expose DTO, should i be validating DTO as well as Entity. If i validate only DTO then i am not providing any input validations for my Enitity object . is this ok?

1. You should validate DTOs regardless of whether you validate entities or not. As already said, DTOs contain any garbage from client. It's responsibility of Service Layer to validate every service method parameter value, and call the underlying Domain Layer with only correct values.

2. It is OK to remove validation from entities if you are sure to do all data validations before accessing entities.