It is bad practice in terms of software engineering, but some "real world" apps are implemented like this. They do verification in the "middleware".