Ktor

Install Authentication and configure a named provider, then wrap the routes in authenticate("name") { }. Inside a handler, call.principal<T>() returns whatever the provider's validate block produced; routes outside the block stay public.

Construct an HttpClient with an engine, then call the suspend function client.get(url). It returns an HttpResponse: read the code from response.status and the payload from response.bodyAsText() or the typed response.body<T>().

Ktor's pipelines natively handle only bytes, text and form data. ContentNegotiation registers converters that map a media type to a class, so without it no converter exists for User and both the receive and the respond transformation fail.

Ktor's install() adds a plugin to a pipeline and runs its configuration block once at startup. Plugins can be installed application-wide inside a module, or — when the plugin is route-scoped — on a single route so only that subtree is affected.

Put the parameter in the path template — get("/users/{id}") — and read it with call.parameters["id"]. Query string values come from call.request.queryParameters. Both return nullable strings, so you convert and validate them yourself.

In Ktor's jwt provider, verifier supplies the token verifier that checks the signature and standard claims before your code runs; validate then receives the already-verified JWTCredential and decides, in application terms, whether to return a principal or null.

Ktor's client core only converts payloads to bytes, text and channels. Typed conversion needs a converter, supplied by the client ContentNegotiation plugin; without it body<User>() throws NoTransformationFoundException because no registered converter can produce that type.

Ktor's ApplicationCallPipeline has the phases Setup, Monitoring, Plugins, Call and Fallback, executed in that order. Within one phase, interceptors run in the order they were registered, so both the phase and the install order decide placement.

Ktor builds a routing tree, evaluates every branch that matches, scores each one, and runs the highest-scoring handler. A constant segment outranks a path parameter, which outranks a wildcard, which outranks a tailcard. Declaration order is not the tiebreaker.

Ktor ships no permission model, so authorization is code you add inside the authenticated subtree: either an explicit check in the handler, or a route-scoped plugin that hooks AuthenticationChecked, reads the principal's roles and responds 403 before the handler runs.

A Ktor HttpClient owns an engine with threads, connections and plugin state such as cookie storage and cached tokens. Creating one per request multiplies those resources, discards warm connections and state, and leaks unless every instance is closed.

Netty is the default and the safest production choice on the JVM. CIO is Ktor's own pure-Kotlin engine, the one that works on non-JVM targets and keeps dependencies minimal. Jetty and Tomcat exist mainly for servlet-container compatibility.

Go through the application environment's config object: from an Application receiver, call environment.config.property("path.to.key").getString(), or propertyOrNull for an optional value. The config is the parsed application.conf tree, so custom keys live alongside Ktor's own.

Two plugins cooperate: Sessions defines a typed session carried in a cookie, and Authentication's session provider validates it per request. A login route calls call.sessions.set(...); protected routes wrap in authenticate and read the principal.

A Ktor client engine is the pluggable implementation that actually performs requests. HttpClient is the shared API; the engine comes from a separate artifact passed as HttpClient(CIO), HttpClient(OkHttp), HttpClient(Darwin), and differs per platform and capability.

Ktor's client sets expectSuccess to false by default, so a 404 returns a normal HttpResponse you must inspect via response.status. Setting expectSuccess = true makes non-2xx responses throw ClientRequestException, ServerResponseException or RedirectResponseException instead.

Ktor's json() uses kotlinx.serialization: a compiler plugin generates serializers at build time for @Serializable types. jackson() wraps a Jackson ObjectMapper that works by runtime reflection on any class, annotated or not. Compile-time safety versus reflective flexibility.

A multipart/form-data body is a stream of independently typed parts, not one document a converter can turn into a single object. Ktor exposes it as MultiPartData, iterated with forEachPart, so large files stream to disk instead of loading into memory.

Build it with createApplicationPlugin, giving a name and handlers such as onCall, onCallReceive and onCallRespond; add a configuration class if it needs settings. Use createRouteScopedPlugin instead when the behaviour should apply to one route subtree rather than the whole server.

Inside Ktor's routing block, call staticResources("/assets", "assets") to serve files packaged on the classpath, or staticFiles("/files", File("files")) to serve a directory on disk. Both take a URL prefix, a base location, and an optional index file.

Keep one config file that defines the shape and bind sensitive or environment-specific values to HOCON substitutions such as port = ${?PORT}. EngineMain also accepts command-line overrides, so the deploy can set values without a rebuild and the code still reads a single config tree.

The challenge block defines the response sent when no provider authenticated the caller — the default 401 with a WWW-Authenticate header for basic, or whatever you write: a JSON error body for an API, a redirect to a login page for a browser application.

Install StatusPages alongside ContentNegotiation and register exception handlers for the conversion failures — Ktor's BadRequestException and the converter's own convert exception — responding with a serializable error DTO. Unhandled, those exceptions escape the handler and become 500s.

Check three things in order: that CORS is installed on a pipeline the request actually passes through, that the configuration matches the browser's origin, method and requested headers exactly, and that nothing responded and finished the pipeline before the plugin ran.

Split the tree into Route extension functions, one per feature — fun Route.orderRoutes(service: OrderService) — living beside that feature's code, and call them from a single routing block that owns shared prefixes. Handlers stay thin: parse, delegate, respond.

Install the WebSockets plugin on the HttpClient, then call client.webSocket("wss://host/path") { ... }. Inside the block you send with send(Frame.Text(...)) and read from incoming; the session closes when the block returns.

It replaces string path templates with serializable classes: install Resources, annotate a class with @Resource("/articles"), then handle it with get<Articles> { articles -> }. Path and query values arrive as typed properties, and href builds URLs from an instance.

Register a converter against that exact ContentType inside install(ContentNegotiation). Ktor's json() and jackson() both accept a contentType parameter, and register(contentType, converter) binds any ContentConverter to any media type, including several in one application.