Do Not Expect Anything from Web Services

The thing about services is that you have to expect to not be able to expect anything from the caller. It might be another system, an experienced developer, someone with a bit of knowledge or someone that has found it by mistake and wants to give it a try.

Obviously in systems with built in security you don’t need to worry so much about the person who finds it by mistake but it is important, no matter who or what is expected to use the service, that you always check for the data that you are receiving before attempting to use it.