Ktor 3.5

Apply the Kotlin 2.4 prompt first. These rules cover Ktor 3.5.2 on the JVM and Ktor clients used by the server. Ktor's core JVM baseline is Java 8; the Jetty Jakarta engine requires Java 17 or newer. Match the deployed JDK to the selected engine and application bytecode, and use a vendor-supported, patched runtime.

Dependencies, routing, and authentication

• Keep every Ktor module and the Ktor Gradle plugin on the same Ktor release through the Ktor BOM or the plugin's dependency management, and check resolved engine and serializer dependencies for security updates. Read each patch release's notes as well as scanner output: the 3.5 patches carried rate-limit, session-encryption, and engine fixes as ordinary release-note bug fixes.
• Install Authentication before declaring authenticate(...) routes. Place every protected method, nested route, download, and upgrade inside the intended scope; inspect route-local plugin overrides and fallback routes for equivalent protection.
• Choose AuthenticationStrategy explicitly when combining providers: FirstSuccessful accepts any one, Required requires every provider registered with that strategy, and Optional permits missing credentials. Keep optional authentication and skipWhen predicates away from mandatory identity checks.
• Retrieve the intended provider's call.principal<T>(providerName) and authorize the resolved resource, operation, and tenant before use. In an AuthenticationChecked authorization hook, reject a missing principal; the hook's execution alone does not establish authentication. Return from