# MiddlewareInterface question regarding practices with auth

**URL:** <https://discourse.laminas.dev/t/middlewareinterface-question-regarding-practices-with-auth/103>\
**Category:** Mezzio\
**Created:** [May 8, 2017, 1:01pm UTC](https://discourse.laminas.dev/t/middlewareinterface-question-regarding-practices-with-auth/103 "2017-05-08T13:01:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![belgattitude](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/belgattitude/32/241_2.png) [@belgattitude](https://discourse.laminas.dev/u/belgattitude)\
**Post date:** [May 8, 2017, 1:01pm UTC](https://discourse.laminas.dev/t/middlewareinterface-question-regarding-practices-with-auth/103/1 "2017-05-08T13:01:42Z")

</div>

Hi,

Fairly new to middleware concept and start to feel confortable with delegation `MiddlewareInterface::process()`, but what’s the recommended way to handle _error_ responses (unauthorized, redirect response, content-types…) ?

For example:

```auto
class JwtAuthMiddleware implements ServerMiddlewareInterface
{
    public function process(ServerRequestInterface $request, DelegateInterface $delegate): ResponseInterface
    {
        $auth = $this->authenticate($jwtToken=?, $login=?, $password=?);
        if ($auth->isValid()) {
           $response = $delegate->process($request->withAttribute('xxxx', $auth));
           $response->writeTokenInSecureToken();
           return $response;
        } 

       // Not authenticated - my question is about this:
       switch($type) {
           case 'json':
                return new JsonResponse(['message' => 'unauthorized'], 401);
                break;
          // case 'xml': ...
           default:
                return new RedirectResponse('/login');       
       }
    }

```

Is there a recommended approach for doing this ? (ErrorResponse, UnauthorizedResponse factory ?)

PS: an early WIP example code: [https://github.com/belgattitude/soluble-wallit/blob/99b91f50694b5f165ea7c60b0bf451991a20f399/src/Soluble/Wallit/JwtAuthMiddleware.php#L79](https://github.com/belgattitude/soluble-wallit/blob/99b91f50694b5f165ea7c60b0bf451991a20f399/src/Soluble/Wallit/JwtAuthMiddleware.php#L79)

---

<div class="post-metadata">

**Author:** ![moderndeveloperllc](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/moderndeveloperllc/32/79_2.png) [@moderndeveloperllc](https://discourse.laminas.dev/u/moderndeveloperllc)\
**Post date:** [May 8, 2017, 9:26pm UTC](https://discourse.laminas.dev/t/middlewareinterface-question-regarding-practices-with-auth/103/2 "2017-05-08T21:26:50Z")

</div>

First and foremost, check with the [docs on how to handle errors](https://docs.zendframework.com/zend-expressive/features/error-handling/). Basically, If you want to use the “built-in” error handling, you should include `Zend\Stratigility\Middleware\ErrorHandler` at the front of your app pipeline and throw exceptions in your middleware. For instance, I’m using a bearer token (similar to what I see above) from the request header. One of the sections I have in my token service:

```auto
$authHeader = $request->getHeader('Authorization');
if (!$authHeader) {
    throw new InvalidArgumentException('Authorization Header Not Found', StatusCode::STATUS_UNAUTHORIZED);
}

```

The exception will be caught by `ErrorHandler`. You can add listeners (logging, etc) and an error generator to the `ErrorHandler` object via a factory to help handle creating the JSON/XML/HTML response.

–MDG

Edit: Clarify where to add listeners and error message generator.

---

<div class="post-metadata">

**Author:** ![belgattitude](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/belgattitude/32/241_2.png) [@belgattitude](https://discourse.laminas.dev/u/belgattitude)\
**Post date:** [May 9, 2017, 3:45pm UTC](https://discourse.laminas.dev/t/middlewareinterface-question-regarding-practices-with-auth/103/3 "2017-05-09T15:45:27Z")

</div>

Thanks @moderndeveloperllc, was not aware of that

---

<div class="post-metadata">

**Author:** ![moderndeveloperllc](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/moderndeveloperllc/32/79_2.png) [@moderndeveloperllc](https://discourse.laminas.dev/u/moderndeveloperllc)\
**Post date:** [May 9, 2017, 4:01pm UTC](https://discourse.laminas.dev/t/middlewareinterface-question-regarding-practices-with-auth/103/4 "2017-05-09T16:01:42Z")

</div>

@belgattitude Glad to help. I’ve been rewriting an app off and on for the past handful of months into an Expressive 1, then Expressive 2 implementation. Once you get into the flow, it’s a nice, minimalist framework. Good luck on your project!