what's best place to authorize API call in zend

Question

I am creating APIs in zend framework. I want to authorize each API call. I am passing some information in header which is used for authorization purpose.

Currently I am authorizing API calls in module.php but the problem I faced in this is I am not able to return proper response code. If authorization fails, it should return 403.

Is there any other place than Module.php where I can authorize all the API calls ?

Answer 1

I have done this in Module.php as it's called before any of the controllers.

Advantage of doing this in module.php

1)You don't have to do this in all the controllers

2)We can directly return error response from the Module.php if call is not authorized.

Answer 2

I'm using https://github.com/php-loep/oauth2-server (oauth2)

I do authorizations in controller.

Answer 3

If you want to send HTTP response the better place would be controller or view, since you had mentioned API you could return null or some other error codes(responses) to alert the models/modules that are going to use your API