// Don't follow redirects to unsupported protocols.
    val url = userResponse.request.url.resolve(location) ?: return null

    // If configured, don't follow redirects between SSL and non-SSL.
    val sameScheme = url.scheme == userResponse.request.url.scheme
    if (!sameScheme && !client.followSslRedirects) return null

    // Most redirects don't include a request body.

## Rewriting Responses

If transparent compression was used, OkHttp will drop the corresponding response headers `Content-Encoding` and `Content-Length` because they don’t apply to the decompressed response body.

If a conditional GET was successful, responses from the network and cache are merged as directed by the spec.

## Follow-up Requests

          ******@****.***ions = extensions
          if (!extensions.isValid()) {
            synchronized(this@RealWebSocket) {
              messageAndCloseQueue.clear() // Don't transmit any messages.
              close(1010, "unexpected Sec-WebSocket-Extensions in response header")
            }
          }

          // Process all web socket messages.

            connectionUser.releaseConnectionNoEvents()
          }
          else -> null
        }
      }

    // If the call's connection wasn't released, reuse it. We don't call connectionAcquired() here
    // because we already acquired it.
    if (connectionUser.candidateConnection() != null) {
      check(toClose == null)
      return ReusePlan(candidate)
    }

fun retryTlsHandshake(e: IOException): Boolean {
  return when {
    // If there was a protocol problem, don't recover.
    e is ProtocolException -> false

    // If there was an interruption or timeout (SocketTimeoutException), don't recover.
    // For the socket connect timeout case we do not try the same host with a different
    // ConnectionSpec: we assume it is unreachable.

   * Does nothing if there are no certificates pinned for `hostname`. OkHttp calls this after a
   * successful TLS handshake, but before the connection is used.
   *
   * @throws SSLPeerUnverifiedException if `peerCertificates` don't match the certificates pinned
   *     for `hostname`.
   */
  @Throws(SSLPeerUnverifiedException::class)
  fun check(
    hostname: String,
    peerCertificates: List<Certificate>,
  ) {

  ) {
    fun selectProxies(): List<Proxy> {
      // If the user specifies a proxy, try that and only that.
      if (proxy != null) return listOf(proxy)

      // If the URI lacks a host (as in "http://</"), don't call the ProxySelector.
      val uri = url.toUri()
      if (uri.host == null) return immutableListOf(Proxy.NO_PROXY)

      // Try each of the ProxySelector choices until one connection succeeds.

  val knownFailures =
    setOf(
      // OkHttp rejects empty labels.
      "x..xn--zca",
      "x..ß",
      // OkHttp rejects labels longer than 63 code points, the web platform tests don't.
      "x01234567890123456789012345678901234567890123456789012345678901x.xn--zca",
      "x01234567890123456789012345678901234567890123456789012345678901x.ß",
      "x01234567890123456789012345678901234567890123456789012345678901x",

    toolVersion = rootProject.libs.versions.checkStyle.get()
    sourceSets = listOf(project.sourceSets["main"])
  }

  // Animal Sniffer confirms we generally don't use APIs not on Java 8.
  configure<AnimalSnifferExtension> {
    annotation = "okhttp3.internal.SuppressSignatureCheck"
    sourceSets = listOf(project.sourceSets["main"])
  }

### Choosing between application and network interceptors

Each interceptor chain has relative merits.

**Application interceptors**

 * Don't need to worry about intermediate responses like redirects and retries.
 * Are always invoked once, even if the HTTP response is served from the cache.