When adding authentication to a website, do you wrap all the routes which the user must be logged into to with

authenticate()

or do you just add

authenticate()

to the routes which actually do the authentication? I'm terribly confused.

The latter

So for every route which should only be accessible to authenticated users, I have to check the session state myself?

Yes. There is no built-in functionality for this.

I'm using (well, experimenting with) Oauth using AWS Cogito.

Then my answer is correct :)

The ktor examples seem to put the callback URL inside the authenticate block. That crashes when I'm running ktor on AWS lambda through kotless. Works when the callback is not in authenticate. The osiris framework I've previously used for serverless puts all routes which should be secure inside the authenticate block and handles it automatically. Which was nice 😊.