Ktor 3.6.0 Introduces Typed Authentication and HTTP/3 Support
Latest release brings experimental features for backend developers
1Major authentication overhaul
Ktor 3.6.0 introduces typed authentication capabilities, replacing implicit typing with full type safety. The new system supports role-based access, anonymous users, and leverages context parameters for cleaner syntax. Developers can now work with complex authentication scenarios while maintaining compile-time safety, particularly beneficial for JWT implementations where payload claims are directly mapped to user types.
2OpenID Connect integration
The new Oidc plugin simplifies integration with OpenID Connect providers, offering typed authentication with support for all OpenID features. It includes browser login interfaces with auto-refreshing tokens and session management. This standardized approach reduces implementation complexity for services requiring enterprise-grade authentication while maintaining Ktor's type-safe philosophy through clearly defined identity providers and bearer token configurations.
3HTTP/3 experimental support
Netty engine now supports HTTP/3 over QUIC protocol, configurable through SSL connectors with specific enableHttp3 blocks. Developers can tune QUIC-specific parameters like flow-control limits and UDP socket configurations. The release also allows simultaneous h2c and HTTP/2 over TLS on different connectors, providing flexibility for transitional architectures adopting newer HTTP versions.
4Enhanced routing capabilities
Route handlers now support Kotlin's Uuid, Byte, and unsigned numeric types for parameter conversion. The receive() method accepts nullable types, making route contracts more explicit while deprecating receiveNullable(). New respondHtmlPartial replaces the deprecated respondHtmlFragment, offering unrestricted partial HTML responses using TagConsumer<Appendable> with full FlowContent element support.
5Content negotiation control
Client ContentNegotiation plugin behavior is now configurable regarding Accept headers. With ContentTypeMergeStrategy.SkipIfPresent, explicit Accept headers remain unchanged while requests without headers still benefit from registered content types. This solves edge cases where APIs require precise header values while maintaining the plugin's convenience for typical use cases.
6KMP client improvements
ktor-client-engine-defaults provides curated engine selection for Kotlin Multiplatform projects, eliminating the need to specify engines in shared code. HTTP cache storage now uses kotlinx-io Path, removing JVM File API dependency. These changes simplify KMP client setup while preserving platform-specific configuration options when needed.
7Additional quality-of-life updates
Release includes WebRTC support for JVM, asynchronous DNS resolution for CIO, OpenAPI tag descriptions, and duplicate-cookie parsing. JavaScript fetch() overrides provide better control in browser environments. The update maintains backward compatibility while introducing these experimental features, allowing gradual adoption in existing projects.
8Community-driven evolution
Ktor 3.6.0 incorporates contributions from community members like kdelay, Rafa Ruiz, and solo. The interactive project generator at start.ktor.io helps developers quickly explore new features. This release demonstrates how community feedback shapes Ktor's development, particularly in balancing type safety with practical web development needs across different platforms and protocols.
Original article: The JetBrains Blog — Ktor 3.6.0 Introduces Typed Authentication and HTTP/3 Support