Ktor 3.6

Apply the Kotlin 2.4 prompt first. These rules cover the Ktor 3.6 JVM server, its installed plugins, and Ktor clients used by that server. Keep Ktor modules, engine artifacts, and the Ktor Gradle plugin aligned through the Ktor BOM or plugin dependency management. Match the deployed JDK to the selected engine and its bytecode requirements.

Routes, identity, and access

• Protect each sensitive route, HTTP method, static download, WebSocket upgrade, and SSE stream with the intended authenticate(...) or authenticateWith(...) scope. Check nested routes and route-local plugin overrides; installing Authentication alone does not restrict a route.
• For named providers, choose AuthenticationStrategy deliberately when combining them: FirstSuccessful accepts one, Required requires all, and Optional permits missing credentials. Never let an optional provider, skipWhen, or a fallback route satisfy a mandatory identity check.
• With the experimental typed API, use authenticateWith(scheme) for protected routes. Use authenticateWithOptional or orAnonymous() only where anonymous access is intended, and treat call.principalOrNull or an anonymous principal as unauthenticated. authenticateWithAnyOf accepts the first successful scheme; authorize the resulting identity for the requested operation, object, and tenant.
• Make each basic, form, bearer, session, or custom validate block return a principal only after verifying credentials and current account eligibility. Check ownership in the handler or an authorization hook for every object lookup. Typed