When adding authentication to a website, do you wrap all the routes which the user must be logged in...

# ktor

[v79]

When adding authentication to a website, do you wrap all the routes which the user must be logged into to with authenticate() or do you just add authenticate() to the routes which actually do the authentication? I'm terribly confused.

[Dominaezzz]

The latter

[v79]

So for every route which should only be accessible to authenticated users, I have to check the session state myself?

[Aleksei Tirman [JB]]

Yes. There is no built-in functionality for this.

[Aleksei Tirman [JB]]

@v79 what authentification method do you use?

[v79]

I'm using (well, experimenting with) Oauth using AWS Cogito.

[Aleksei Tirman [JB]]

Then my answer is correct :)

[v79]

The ktor examples seem to put the callback URL inside the authenticate block. That crashes when I'm running ktor on AWS lambda through kotless. Works when the callback is not in authenticate.
The osiris framework I've previously used for serverless puts all routes which should be secure inside the authenticate block and handles it automatically. Which was nice 😊.