Security
========

## Supported Versions

| Version | Supported           | Notes                                        |
| ------- | ------------------- | -------------------------------------------- |
| 5.x     | ✅                  | APIs subject to change in alpha releases.    |
| 4.x     | ✅                  | Android 5.0+ (API level 21+) and on Java 8+. |
| 3.x     | ❌ Ended 2021-12-31 | Android 2.3+ (API level 9+) and Java 7+.     |

| [Corretto]       | ✅      | ✅           | [OpenSSL]       | Amazon's high-performance provider. [Tracking bug.][bug5592] |

All providers support HTTP/1.1 and TLSv1.2.


[BoringSSL]: https://boringssl.googlesource.com/boringssl/
[Bouncy Castle]: https://www.bouncycastle.org/java.html
[Conscrypt]: https://www.conscrypt.org/

    if (bytesLeft == -1L || constructed) {
      throw ProtocolException("constructed octet strings not supported for DER")
    }
    return source.readByteString(bytesLeft)
  }

  fun readUtf8String(): String {
    if (bytesLeft == -1L || constructed) {
      throw ProtocolException("constructed strings not supported for DER")
    }
    return source.readUtf8(bytesLeft)
  }

  fun readObjectIdentifier(): String {

 * **REMOVED:** ~~TLS_AES_128_CCM_8_SHA256[¹][tlsv13_only]~~

[OkHttp 3.13][OkHttp313]
------------------------

_2019-02-04_

Remove TLSv1.1 and TLSv1 from MODERN_TLS. Change COMPATIBLE_TLS to support all TLS versions.

##### RESTRICTED_TLS versions

* TLSv1.3
* TLSv1.2

##### MODERN_TLS versions

* TLSv1.3
* TLSv1.2
* **REMOVED:** ~~TLSv1.1~~
* **REMOVED:** ~~TLSv1~~

    .build();
```

The TLS versions and cipher suites in each spec can change with each release. For example, in OkHttp 2.2 we dropped support for SSL 3.0 in response to the [POODLE](https://googleonlinesecurity.blogspot.ca/2014/10/this-poodle-bites-exploiting-ssl-30.html) attack. And in OkHttp 2.3 we dropped support for [RC4](https://en.wikipedia.org/wiki/RC4#Security). As with your desktop web browser, staying up-to-date with OkHttp is the best way to stay secure.

    return parentFile.isDescendentOf(directory)
  }

  /**
   * See FinalizationTester for discussion on how to best trigger GC in tests.
   * https://android.googlesource.com/platform/libcore/+/master/support/src/test/java/libcore/
   * java/lang/ref/FinalizationTester.java
   */
  @Throws(Exception::class)
  @JvmStatic
  fun awaitGarbageCollection() {
    Runtime.getRuntime().gc()
    Thread.sleep(100)

  compileOnly(libs.bouncycastle.bctls)
  compileOnly(libs.conscrypt.openjdk)
  compileOnly(libs.openjsse)
  compileOnly(libs.findbugs.jsr305)
  compileOnly(libs.animalsniffer.annotations)

  // graal build support
  compileOnly(libs.nativeImageSvm)

  testCompileOnly(libs.bouncycastle.bctls)
  testImplementation(projects.okhttpTestingSupport)
  testImplementation(libs.assertk)

    fun isCacheable(
      response: Response,
      request: Request,
    ): Boolean {
      // Always go to network for uncacheable response codes (RFC 7231 section 6.1), This
      // implementation doesn't support caching partial content.
      when (response.code) {
        HTTP_OK,
        HTTP_NOT_AUTHORITATIVE,
        HTTP_NO_CONTENT,
        HTTP_MULT_CHOICE,
        HTTP_MOVED_PERM,
        HTTP_NOT_FOUND,

   * while other events occur sequentially; cancels may occur concurrently with other events. For
   * example, thread A may be executing [responseBodyStart] while thread B executes [canceled].
   * Implementations must support such concurrent calls.
   *
   * Note that cancellation is best-effort and that a call may proceed normally after it has been
   * canceled. For example, happy-path events like [requestHeadersStart] and [requestHeadersEnd] may

   * HTTP/2. This is true by default; set to false to disable negotiation and restrict connections
   * to HTTP/1.1.
   */
  var protocolNegotiationEnabled: Boolean = true

  /**
   * The protocols supported by ALPN on incoming HTTPS connections in order of preference. The list
   * must contain [Protocol.HTTP_1_1]. It must not contain null.
   *
   * This list is ignored when [negotiation is disabled][protocolNegotiationEnabled].