developers and others in the free software community to coordinate our efforts.

 * **Be pragmatic**: Questions are encouraged and should be asked early in the process to avoid
   problems later. Be thoughtful and considerate when seeking out the appropriate forum for your
   questions. Those who are asked should be responsive and helpful.

 * **Step down considerately**: Members of every project come and go. When somebody leaves or

## Version 3.12.0

_2018-11-16_

 *  **OkHttp now supports TLS 1.3.** This requires either Conscrypt or Java 11+.

 *  **Proxy authenticators are now asked for preemptive authentication.** OkHttp will now request
    authentication credentials before creating TLS tunnels through HTTP proxies (HTTP `CONNECT`).

   * [WindowCounter] generally carries the client view of total and acked bytes.
   */
  fun receivingStreamWindowChanged(
    streamId: Int,
    windowCounter: WindowCounter,
    bufferSize: Long,
  )

  /**
   * Notification that the receiving connection flow control window has changed.
   * [WindowCounter] generally carries the client view of total and acked bytes.
   */

    if (stream != null) return

    val hasRequestBody = request.body != null
    val requestHeaders = http2HeadersList(request)
    stream = http2Connection.newStream(requestHeaders, hasRequestBody)
    // We may have been asked to cancel while creating the new stream and sending the request
    // headers, but there was still no stream to close.
    if (canceled) {
      stream!!.closeLater(ErrorCode.CANCEL)
      throw IOException("Canceled")
    }

        .isEqualTo("Client-sent frames must be masked.")
    }
  }

  @Test fun serverSentFramesMustNotBeMasked() {
    data.write("8180".decodeHex())
    assertFailsWith<ProtocolException> {
      clientReader.processNextFrame()
    }.also { expected ->
      assertThat(expected.message)
        .isEqualTo("Server-sent frames must not be masked.")
    }
  }

  @Test fun controlFramePayloadMax() {

    client.webSocket!!.close(1000, "Hello")
    server.processNextFrame()
    // Not closed until close reply is received.
    assertThat(client.closed).isFalse()

    // Manually write an invalid masked close frame.
    server.sink.write("888760b420bb635c68de0cd84f".decodeHex()).emit()
    client.processNextFrame() // Detects error, disconnects immediately since close already sent.
    client.webSocket!!.finishReader()

  internal const val B0_MASK_OPCODE = 15

  /** Flag in the opcode which indicates a control frame. */
  internal const val OPCODE_FLAG_CONTROL = 8

  /**
   * Byte 1 flag for whether the payload data is masked.
   *
   * If this flag is set, the next four
   * bytes represent the mask key. These bytes appear after any additional bytes specified by [B1_MASK_LENGTH].
   */
  internal const val B1_FLAG_MASK = 128

  /**

    val isMasked = b1 and B1_FLAG_MASK != 0
    if (isMasked == isClient) {
      // Masked payloads must be read on the server. Unmasked payloads must be read on the client.
      throw ProtocolException(
        if (isClient) {
          "Server-sent frames must not be masked."
        } else {
          "Client-sent frames must be masked."
        },
      )
    }

      }
    ```

### Handling authentication ([.kt][AuthenticateKotlin], [.java][AuthenticateJava])

OkHttp can automatically retry unauthenticated requests. When a response is `401 Not Authorized`, an `Authenticator` is asked to supply credentials. Implementations should build a new request that includes the missing credentials. If no credentials are available, return null to skip the retry.

    peer.acceptFrame() // RST_STREAM
    peer.play()

    // Play it back.
    val connection = connect(peer)
    connection.writePingAndAwaitPong() // Make sure settings have been acked.
    val stream = connection.newStream(headerEntries("b", "banana"), true)
    connection.writePingAndAwaitPong() // Make sure the window update has been received.
    val sink = stream.getSink()