Trying to set up OAuth with Ktor, providerLookup problems

So Im trying to set up OAuth for Kotlin, Ktor. Im trying to follow the documentation
on but I get stuck on the config part on step 2. When my program runs:

call.request.queryParameters["redirectUrl"]!!

I get a null point exeption. When running the program in a debugger mode I can see that call/request/queryParameters is not null. So it should be the "redirectUrl" that is not "working".

I have tried to search for what the line is suppose to do but I cant find any explanation of it anywhere. I can only finds its use in this documentation. I assume it is suppose to get some redirecting URLs but I have no clue from where.

What can I do to solve my null point exeption?

Here is my class if it helps

package com.example.plugins
import io.ktor.server.auth.*
import io.ktor.client.*
import io.ktor.client.engine.apache.*
import io.ktor.http.*
import io.ktor.serialization.kotlinx.json.*
import io.ktor.server.sessions.*
import io.ktor.server.response.*
import io.ktor.server.application.*
import io.ktor.server.plugins.contentnegotiation.*
import io.ktor.server.routing.*
fun Application.configureSecurity() {
val redirects = mutableMapOf<String, String>()
authentication {
oauth("auth-oauth-google") {
urlProvider = { "http://localhost:8086/callback" }
providerLookup = {
OAuthServerSettings.OAuth2ServerSettings(
name = "google",
authorizeUrl = "https://accounts.google.com/o/oauth2/auth",
accessTokenUrl = "https://accounts.google.com/o/oauth2/token",
requestMethod = HttpMethod.Post,
clientId = System.getenv("GOOGLE_CLIENT_ID"),
clientSecret = System.getenv("GOOGLE_CLIENT_SECRET"),
defaultScopes = listOf("https://www.googleapis.com/auth/userinfo.profile"),
extraAuthParameters = listOf("access_type" to "offline"),
onStateCreated = { call, state ->
redirects[state] = call.request.queryParameters["redirectUrl"]!!
}
)
}
client = HttpClient(Apache)
}
}
data class MySession(val count: Int = 0)
install(Sessions) {
cookie<MySession>("MY_SESSION") {
cookie.extensions["SameSite"] = "lax"
cookie.maxAgeInSeconds = 120
cookie.path = "/testing"
}
cookie<UserSession>("USER_SESSION") {
cookie.extensions["SameSite"] = "lax"
cookie.maxAgeInSeconds = 120
cookie.path = "/testingss"
}
}
routing {
authenticate("auth-oauth-google") {
get("login") {
call.respondRedirect("/callback")
}
get("/callback") {
val principal: OAuthAccessTokenResponse.OAuth2? = call.principal()
call.sessions.set(UserSession(principal!!.state!!, principal.accessToken))
val redirect = redirects[principal.state!!]
call.respondRedirect(redirect!!)
}
}
get("/session/increment") {
val session = call.sessions.get<MySession>() ?: MySession()
call.sessions.set(session.copy(count = session.count + 1))
call.respondText("Counter is ${session.count}. Refresh to increment.")
}
}

}

If you need to redirect a client to the URL it came from, add the query parameter redirectUrl (the actual name doesn't matter but has to be consistent) to the /login endpoint. Here are the steps of the flow:

1. Client requests an unprotected endpoint
2. If the session is absent (the client is unauthenticated), the server responds with a redirect to /login with a query parameter redirectUrl, which contains the requested URL.
3. The /login endpoint triggers OAuth2 authentication, and when a state is created, the redirectUrl is saved to the redirects map inside the onStateCreated block.
4. The client is redirected by the OAuth2 provider to the callback URL, where the redirect is happening to the previously saved URL.

Here is an example:

get("/{path}") {
val userSession: UserSession? = call.sessions.get()
if (userSession != null) {
val userInfo: UserInfo = httpClient.get("https://www.googleapis.com/oauth2/v2/userinfo") {
headers {
append(HttpHeaders.Authorization, "Bearer ${userSession.token}")
}
}.body()
call.respondText("Hello, ${userInfo.name}!")
} else {
val redirectUrl = URLBuilder("http://0.0.0.0:8080/login").run {
parameters.append("redirectUrl", call.request.uri)
build()
}
call.respondRedirect(redirectUrl)
}
}

I was able to fix it by exchanging call.request.queryParameters["redirectUrl"]!! with just a normal string, such as "http://localhost:3000/home".

Works as long as you only have the same url you are going to redirect to.

The answer given is not addressing the problem. There is NullPointerException when the ktor oauth model example is used.

Also, in the get("/{path}") {} block, for the case when there is a existing session avilable, how do we redirect? If I try to call.respondRedirect(), it again lands into get("/{path}") {} block. This is infinite loop.