title: Where should the authorization logic go in an api based application?
body: <p>I have a brand new Rails api based application, where i need to implement authorization.  </p>
  
  <p>Overall Architecture:</p>
  
  <p><code>React frontend -&gt; Rails API layer -&gt; Rails model/server layer</code></p>
  
  <p>While exploring different approaches, I have got a confusion.</p>
  
  <ol>
  <li>Should we put the authorization logic in API layer or Service layer?</li>
  <li><strong>API Layer Approach:</strong>   We will build some authorization middleware that will sit between our front end and API layer and all our api calls will be routed thorough the authorization middleware to check if the user is allowed to call that parituclar api.</li>
  <li><strong>Service Layer:</strong> All the authorization check will go to service layer and we will have check before every db operation if the user is allowed to do so. (Using <code>cancancan / pundit</code>) and if the user is not allowed throw the error message to API layer.</li>
  </ol>
  
  <p>It would be a great help, if someone could suggest based on their experience.</p>