Specific security vs. connectivity decisions are implemented by [ConnectionSpec](https://square.github.io/okhttp/4.x/okhttp/okhttp3/-connection-spec/). OkHttp includes four built-in connection specs:

 *
 * Sometimes you'll want to show resources if they are available immediately, but not otherwise.
 * This can be used so your application can show *something* while waiting for the latest data to be
 * downloaded. To restrict a request to locally-cached resources, add the `only-if-cached`
 * directive:
 *
 * ```java
 * Request request = new Request.Builder()
 *     .cacheControl(new CacheControl.Builder()
 *         .onlyIfCached()

"2.3 OK"
"2.4 OK"
"2.5 OK"
"2.6 OK"
"2.7 OK"
"2.8 OK"
"2.9 OK"
"3.1 OK"
"3.2 NON-STRICT"
"3.3 NON-STRICT"
"3.4 NON-STRICT"
"3.5 OK"
"3.6 OK"
"3.7 OK"
"4.1.1 OK"
"4.1.2 OK"
"4.1.3 NON-STRICT"
"4.1.4 NON-STRICT"
"4.1.5 OK"
"4.2.1 OK"
"4.2.2 OK"
"4.2.3 NON-STRICT"
"4.2.4 OK"
"4.2.5 OK"
"5.1 OK"
"5.10 OK"
"5.11 OK"
"5.12 OK"
"5.13 OK"
"5.14 OK"

 * limitations under the License.
 */
package okhttp3.tls.internal.der

import okio.ByteString

/**
 * Like a [ByteString], but whose bits are not necessarily a strict multiple of 8.
 */
internal data class BitString(
  val byteString: ByteString,
  /** 0-7 unused bits in the last byte. */
  val unusedBitsCount: Int,
) {

 * decimal digits and dots. This pattern matches strings like "a:.23" and "54" that are neither IP
 * addresses nor hostnames; they will be verified as IP addresses (which is a more strict
 * verification).
 */
private val VERIFY_AS_IP_ADDRESS = "([0-9a-fA-F]*:[0-9a-fA-F:.]*)|([\\d.]+)".toRegex()

/** Returns true if this string is not a host name and might be an IP address. */

    expectedAuthParams["stale"] = "FALSE"
    assertThat(challenges[0].authParams).isEqualTo(expectedAuthParams)
  }

  @Test fun testDigestChallengeWithCamelCasedNames2() {
    // Strict RFC 2617 camelcased.
    val headers =
      Headers.Builder()
        .add(
          "WWW-Authenticate",
          "DIgEsT rEaLm=\"myrealm\", nonce=\"fjalskdflwejrlaskdfjlaskdjflaks" +

    val url = "http://>/".toHttpUrl()
    assertThat(url.host).isEqualTo(">")
    assertThat(url.toUri().host).isNull()
  }

  /**
   * Strip unexpected characters when converting to URI (which is more strict).
   * https://github.com/square/okhttp/issues/5667
   */
  @Test
  fun hostToUriStripsCharacters() {
    val httpUrl = "http://example\".com/".toHttpUrl()

    client =
      client.newBuilder()
        .hostnameVerifier(
          RecordingHostnameVerifier(),
        ) // Attempt RESTRICTED_TLS then fall back to MODERN_TLS.
        .connectionSpecs(Arrays.asList(ConnectionSpec.RESTRICTED_TLS, ConnectionSpec.MODERN_TLS))
        .sslSocketFactory(
          suppressTlsFallbackClientSocketFactory(),
          handshakeCertificates.trustManager,
        )

 *  Fix: Acknowledge and apply inbound HTTP/2 settings atomically. Previously we had a race where we
    could use new flow control capacity before acknowledging it, causing strict HTTP/2 servers to
    fail the call.


## Version 4.1.1

_2019-09-05_

 *  Fix: Don't drop repeated headers when validating cached responses. In our Kotlin upgrade we

    //
    //  * Several characters are forbidden and must throw exceptions if used.
    //  * They don't use percent escaping at all.
    //  * They use punycode for internationalization.
    //  * URI is much more strict than HttpUrl or URL on what's accepted.
    //
    // HttpUrl is quite lenient with what characters it accepts. In particular, characters like '{'