title: Should DTO and Entity both have input validations
body: <p>I have a WCF layer and my Domain Model is behind this WCF layer. I am using Nhibernate as an ORM tool and all my business logic/ Data Access etc will be behind this WCF layer.</p>
  
  <p>I am exposing DTO to my clients. I have below questions</p>
  
  <p>1) Should i create DTOs? is there any harm in exposing entities directly to wcf clients as my entities would also have business logic methods also in doing so i would have to corrupt my entitiy object with WCF attributes which i think is not good?</p>
  
  <p>2) If i expose DTO, should i be validating DTO as well as Entity. If i validate only DTO then i am not providing any input validations for my Enitity object . is this ok?</p>
  
  <p>3) Should i consider validating the DTO in the Application Service layer (WCF layer) using Schema validation? or Should i use IValidator Approach given in article [blog]: <a href="http://lostechies.com/jimmybogard/2007/10/24/entity-validation-with-visitors-and-extension-methods/" rel="noreferrer">http://lostechies.com/jimmybogard/2007/10/24/entity-validation-with-visitors-and-extension-methods/</a> as shown by Jimmy Bogard</p>
  
  <p>Having DTO at times seem redundant to me but i can use it to club details from one or more entities.</p>
  
  <p>I would be exposing this service to various client and thus my DTO will be deriving from some base dto having credential details which i would check for each incoming request before my actual wcf method call (probably using IEndpointBehaviour and IParamInspector)</p>
  
  <hr>
  
  <h3>Edit</h3>
  
  <p>Based on the response I kind of now agree to retain the DTO layer, Here is an exmaple so that scenario become more explicit</p>
  
  <p>Say I have CreateCustomer method accepting CustomerDetailsDTO in my WCF Application Service Layer which may be called by an MVC application.There are some input validations like <br/><br/> 
  <strong><em>Input Validations:</em></strong></p>
  
  <pre>
  i)Name length should be greater than 2 but less than 50
  ii) Age is mandatory and cann not be less than 18
  (Different other field validations)etc <br/>
  </pre>
  
  <p><em><strong>Business Validations:</em></strong></p>
  
  <pre>
  There could then be some business rules to check for dupliate customer <br/>based on say email or some other factor whcih i think should be part of <br/> my Domain business logic and should reside in CustomerEntity class.
  </pre>
  
  <p>Should Input Validation be only applied at service interface layer as we get DTO from client 
  or it should also be applied on CustomerEntity</p>