JWK is a subcomponent of JWT: https://medium.facilelogin.com/jwt-jws-and-jwe-for-not-so-dummies-b63310d201a3

I mean, I will have a lot of micro-permissions, with roles having these permissions or not, as well as per role or per user numeric limits like "User X can do Y Z times at most"

But I now realize that authentication and permissions are a very different things

I see that Ktor supports authentication in various ways, but not user management

And permissions are part of user management and not authentication

Also sorry for writting authentification instead of authentication, it's the french word... 🙂

JWT is very popular but I recently read some critique about it: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/

Meh

While testing my application is throwing

UnsupportedMediaTypeException: Content type */* is not supported

for this test (and probably all others as well)

with(handleRequest(<http://HttpMethod.Post|HttpMethod.Post>, path)) {
assertEquals(HttpStatusCode.BadRequest, response.status())
}

hm, you probably need to set content type for post data

For API standpoint,

Locations

on big project increases messiness. It is a bit hard map API endpoints with logic calls because they both are in different code places. On another hand, I like them, because they map params with object. Do you consider to have something like that:

data class SearchRequest(q: String)

// a lot of code

route(“/api”) {
  get<SearchRequest>(“/search”) {
    //oneline call
  }
}

Nope,

Locations

are designed so that they keep both information about path and parameters. You can create an URL from data class instance, and that’s not possible without information about a path mapping.

Experimenting with websockets in Ktor I find that when the execution exits the

webSocket("/some/address")

clause, the websocket is closed with the

OK

code

that means it does not allow me to save the websocket session object and use it later for data communication

how am I supposed to maintain the connection for later operations?

Which is the correct way to intercept HTTP calls on the phase when

call.response.status()

is already set? I've found many phases declared, but seems like they're local and not visible from

Route

where I'm trying to set interceptor.

Also serving resources from classpath stopped working with new IDEA EAP, when running from IDE. Seems like there's no resources dir in classLoader's path.

pipeline.intercept(ApplicationCallPipeline.Fallback) can get correct http status

Pipeline is a great concept, but it is a little bit hard to get all message I want. This is how I track All in/out http information. besides I can't calculate request cost time in a easier way

you can use

proceed

in a pipeline to effectively wrap the call. So if you install interceptor in the beginning of a pipeline, call

proceed

and after that the call is already being completed

I think,

proceed()

should return result of a call. Relying on state mutation (e. g. on fact that statusCode becomes non-null) introduces procedural temporal coupling.

What is the result of the call?

Immutable version of ApplicationResponse.

That would be costly from performance point of view. We (slowly but steadily) try to reduce allocations as much as we can.

i'm kind of stuck right now. trying to read data from a

POST

request (JSON, i have GSON in

ContentNegotiation

) like this:

val post = call.receiveParameters()

and i'm getting

java.lang.RuntimeException: Unable to invoke no-args constructor for interface io.ktor.util.ValuesMap. Register an InstanceCreator with Gson for this type may fix this problem.

maybe i'm too tired, but i cant find the mistake.

(

call.receive<ValuesMap>()

returns the same exception)

if i create my own

data class

for the received object it's working.. but all the examples (kweet for example) are using

ValuesMap

, so thats kind of weird.

looking at the kweet example, it doesn't look like it's using json, the valuesmap is probably url encoded parameters

@damian you can do

call.receive<JsonObject>

to use Gson, had trouble with that myself