| Version | Supported           | Notes                                        |
| ------- | ------------------- | -------------------------------------------- |
| 5.x     | ✅                  | APIs subject to change in alpha releases.    |
| 4.x     | ✅                  | Android 5.0+ (API level 21+) and on Java 8+. |
| 3.x     | ❌ Ended 2021-12-31 | Android 2.3+ (API level 9+) and Java 7+.     |


## Reporting a Vulnerability

 * [duplex calls][RequestBody.isDuplex] interleave the request and response bodies.
 *
 * Since connections may be reused, the proxy selection, DNS, and connect events may not be present
 * for a call. In future releases of OkHttp these events may also occur concurrently to permit
 * multiple routes to be attempted simultaneously.
 *
 * Events and sequences of events may be repeated for retries and follow-ups.
 *

(double-press shift) or under the _Analyze_ menu.

We’ve included deprecated APIs in OkHttp 4.0 because they make migration easy. We will remove them
in a future release! If you’re skipping releases, it’ll be much easier if you upgrade to OkHttp 4.0
as an intermediate step.

#### Vars and Vals

Java doesn’t have language support for properties so developers make do with getters and setters.

changes we've made over time to OkHttp's default TLS options.

[OkHttp 3.14][OkHttp314]
------------------------

_2019-03-14_

Remove 2 TLSv1.3 cipher suites that are neither available on OkHttp’s host platforms nor enabled in releases of Chrome and Firefox.

##### RESTRICTED_TLS cipher suites

 * TLS_AES_128_GCM_SHA256[¹][tlsv13_only]
 * TLS_AES_256_GCM_SHA384[¹][tlsv13_only]
 * TLS_CHACHA20_POLY1305_SHA256[¹][tlsv13_only]

import okhttp3.OkHttpClient
import okhttp3.Request
import okhttp3.RequestBody.Companion.toRequestBody

class PostString {
  private val client = OkHttpClient()

  fun run() {
    val postBody =
      """
      |Releases
      |--------
      |
      | * _1.0_ May 6, 2013
      | * _1.1_ June 15, 2013
      | * _1.2_ August 11, 2013
      |
      """.trimMargin()

    val request =
      Request(

      = MediaType.get("text/x-markdown; charset=utf-8");

  private final OkHttpClient client = new OkHttpClient();

  public void run() throws Exception {
    String postBody = ""
        + "Releases\n"
        + "--------\n"
        + "\n"
        + " * _1.0_ May 6, 2013\n"
        + " * _1.1_ June 15, 2013\n"
        + " * _1.2_ August 11, 2013\n";

    Request request = new Request.Builder()

          synchronized(this@DiskLruCache) {
            detach()
          }
        }
      }
    }

    /**
     * Commits this edit so it is visible to readers. This releases the edit lock so another edit
     * may be started on the same key.
     */
    @Throws(IOException::class)
    fun commit() {
      synchronized(this@DiskLruCache) {
        check(!done)

Typically HTTP headers work like a `Map<String, String>`: each field has one value or none. But some headers permit multiple values, like Guava's [Multimap](https://guava.dev/releases/23.0/api/docs/com/google/common/collect/Multimap.html). For example, it's legal and common for an HTTP response to supply multiple `Vary` headers. OkHttp's APIs attempt to make both cases comfortable.

        }
        else -> throw expected
      }
    }
  }

  /**
   * Not checking the CA bit created a vulnerability in old OkHttp releases. It is exploited by
   * triggering different chains to be discovered by the TLS engine and our chain cleaner. In this
   * attack there's several different chains.
   *
   *

    assertThat(response.header("Content-Length")).isEqualTo("3")
    assertThat(response.header("etag")).isEqualTo("foo")
  }

  /** Exercise the cache format in OkHttp 2.7 and all earlier releases.  */
  @Test
  fun testGoldenCacheHttpsResponseOkHttp27() {
    val url = server.url("/")
    val urlKey = key(url)
    val prefix = get().getPrefix()
    val entryMetadata =
      """
      $url