如何为API驱动的Web应用程序保留登录凭据

Question

I'm about to embark on developing a front-end that will let users login to a service and perform certain tasks. All of the tasks are being performed through a 3rd party's API using.

I'm doing this with PHP & Zend Framework.

My question: how does one persist the login credentials if every API call requires the login to be passed in the headers?

A user will be authenticated first through a /login controller and then will stay authenticated for their session.

Answer 1

I had simple suggestion

you can write your custom Zend_auth_adapter and I'd like to make it singleton class that can validate your login data over the API and save the result object inside the session object

class My_Auth_adapther implements Zend_Auth_Adapter_Interface {

  public static function getinstance($username , $password ){
      return $this->authenticate($username , $password ); 
  }
  private  function authenticate($username  , $password ){
    // make sure to check if the session has been already created  in order to save one api  request 
    // do your api call (login request ) her 
    // return false if its not valid 
    // or return stdobject that contain ($username , $password ) , for any post usage 
   }
}

and don't allow any further call to your api if that object doesn't exist (in other words == not logged in )