Master data validation in service layer

Question

User enters the data in the forms by choosing values from the master data drop downs in web layer. Data is populated in the dropdowns based on some logic from the master data tables and we know for sure that its a valid master data as far as web layer is concern. Now my question is, should be check the validity of the master data in service layer again because we want to use service layer for mulitple interfaces (Web User Interface, Web Services, Unit Test Cases etc.) or we should validate the master data in respective interfaces only.

Answer 1

In general we should validate incoming data. Right now, we kow that the data, that is sent to the service layer is valid, just because we trust the web frontend. But you already mentioned that the service layer is not restricted to receiving input from that single trusted source.

And as soon as it provides a 'public interface', it should expect receiving invalid data.

I usually stick to the simple paradigm: a sender or data source should always send in an absolutely correct format and a receiver or data sink should always be prepared to receive invalid data. Nice example for this: web servers and browsers.