1 Change Log 2 ========== 3 4 ## Version 2.3.0 5 6 _2015-03-16_ 7 8 * **HTTP/2 support.** We've done interop testing and haven't seen any 9 problems. HTTP/2 support has been a big effort and we're particularly 10 thankful to Adrian Cole who has helped us to reach this milestone. 11 12 * **RC4 cipher suites are no longer supported by default.** To connect to 13 old, obsolete servers relying on these cipher suites, you must create a 14 custom `ConnectionSpec`. 15 16 * **Beta WebSockets support.**. The `okhttp-ws` subproject offers a new 17 websockets client. Please try it out! When it's ready we intend to include 18 it with the core OkHttp library. 19 20 * **Okio updated to 1.3.0.** 21 22 ``` 23 <dependency> 24 <groupId>com.squareup.okio</groupId> 25 <artifactId>okio</artifactId> 26 <version>1.3.0</version> 27 </dependency> 28 ``` 29 30 * **Fix: improve parallelism of async requests.** OkHttp's Dispatcher had a 31 misconfigured `ExecutorService` that limited the number of worker threads. 32 If you're using `Call.enqueue()` this update should significantly improve 33 request concurrency. 34 35 * **Fix: Lazily initialize the response cache.** This avoids strict mode 36 warnings when initializing OkHttp on Androids main thread. 37 38 * **Fix: Disable ALPN on Android 4.4.** That release of the feature was 39 unstable and prone to native crashes in the underlying OpenSSL code. 40 * Fix: Don't send both `If-None-Match` and `If-Modified-Since` cache headers 41 when both are applicable. 42 * Fix: Fail early when a port is out of range. 43 * Fix: Offer `Content-Length` headers for multipart request bodies. 44 * Fix: Throw `UnknownServiceException` if a cleartext connection is attempted 45 when explicitly forbidden. 46 * Fix: Throw a `SSLPeerUnverifiedException` when host verification fails. 47 * Fix: MockWebServer explicitly closes sockets. (On some Android releases, 48 closing the input stream and output stream of a socket is not sufficient. 49 * Fix: Buffer outgoing HTTP/2 frames to limit how many outgoing frames are 50 created. 51 * Fix: Avoid crashing when cache writing fails due to a full disk. 52 * Fix: Improve caching of private responses. 53 * Fix: Update cache-by-default response codes. 54 * Fix: Reused `Request.Builder` instances no longer hold stale URL fields. 55 * New: ConnectionSpec can now be configured to use the SSL socket's default 56 cipher suites. To use, set the cipher suites to `null`. 57 * New: Support `DELETE` with a request body. 58 * New: `Headers.of(Map)` creates headers from a Map. 59 60 61 ## Version 2.2.0 62 63 _2014-12-30_ 64 65 * **`RequestBody.contentLength()` now throws `IOException`.** 66 This is a source-incompatible change. If you have code that calls 67 `RequestBody.contentLength()`, your compile will break with this 68 update. The change is binary-compatible, however: code compiled 69 for OkHttp 2.0 and 2.1 will continue work with this update. 70 71 * **`COMPATIBLE_TLS` no longer supports SSLv3.** In response to the 72 [POODLE](http://googleonlinesecurity.blogspot.ca/2014/10/this-poodle-bites-exploiting-ssl-30.html) 73 vulnerability, OkHttp no longer offers SSLv3 when negotiation an 74 HTTPS connection. If you continue to need to connect to webservers 75 running SSLv3, you must manually configure your own `ConnectionSpec`. 76 77 * **OkHttp now offers interceptors.** Interceptors are a powerful mechanism 78 that can monitor, rewrite, and retry calls. The [project 79 wiki](https://github.com/square/okhttp/wiki/Interceptors) has a full 80 introduction to this new API. 81 82 * New: APIs to iterate and selectively clear the response cache. 83 * New: Support for SOCKS proxies. 84 * New: Support for `TLS_FALLBACK_SCSV`. 85 * New: Update HTTP/2 support to to `h2-16` and `hpack-10`. 86 * New: APIs to prevent retrying non-idempotent requests. 87 * Fix: Drop NPN support. Going forward we support ALPN only. 88 * Fix: The hostname verifier is now strict. This is consistent with the hostname 89 verifier in modern browsers. 90 * Fix: Improve `CONNECT` handling for misbehaving HTTP proxies. 91 * Fix: Don't retry requests that failed due to timeouts. 92 * Fix: Cache 302s and 308s that include appropriate response headers. 93 * Fix: Improve pooling of connections that use proxy selectors. 94 * Fix: Don't leak connections when using ALPN on the desktop. 95 * Fix: Update Jetty ALPN to `7.1.2.v20141202` (Java 7) and `8.1.2.v20141202` (Java 8). 96 This fixes a bug in resumed TLS sessions where the wrong protocol could be 97 selected. 98 * Fix: Don't crash in SPDY and HTTP/2 when disconnecting before connecting. 99 * Fix: Avoid a reverse DNS-lookup for a numeric proxy address 100 * Fix: Resurrect http/2 frame logging. 101 * Fix: Limit to 20 authorization attempts. 102 103 ## Version 2.1.0 104 105 _2014-11-11_ 106 107 * New: Typesafe APIs for interacting with cipher suites and TLS versions. 108 * Fix: Don't crash when mixing authorization challenges with upload retries. 109 110 111 ## Version 2.1.0-RC1 112 113 _2014-11-04_ 114 115 * **OkHttp now caches private responses**. We've changed from a shared cache 116 to a private cache, and will now store responses that use an `Authorization` 117 header. This means OkHttp's cache shouldn't be used on middleboxes that sit 118 between user agents and the origin server. 119 120 * **TLS configuration updated.** OkHttp now explicitly enables TLSv1.2, 121 TLSv1.1 and TLSv1.0 where they are supported. It will continue to perform 122 only one fallback, to SSLv3. Applications can now configure this with the 123 `ConnectionSpec` class. 124 125 To disable TLS fallback: 126 127 ``` 128 client.setConnectionSpecs(Arrays.asList( 129 ConnectionSpec.MODERN_TLS, ConnectionSpec.CLEARTEXT)); 130 ``` 131 132 To disable cleartext connections, permitting `https` URLs only: 133 134 ``` 135 client.setConnectionSpecs(Arrays.asList( 136 ConnectionSpec.MODERN_TLS, ConnectionSpec.COMPATIBLE_TLS)); 137 ``` 138 139 * **New cipher suites.** Please confirm that your webservers are reachable 140 with this limited set of cipher suites. 141 142 ``` 143 Android 144 Name Version 145 146 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 5.0 147 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 5.0 148 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 5.0 149 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 4.0 150 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 4.0 151 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 4.0 152 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 4.0 153 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA 4.0 154 TLS_ECDHE_RSA_WITH_RC4_128_SHA 4.0 155 TLS_DHE_RSA_WITH_AES_128_CBC_SHA 2.3 156 TLS_DHE_DSS_WITH_AES_128_CBC_SHA 2.3 157 TLS_DHE_RSA_WITH_AES_256_CBC_SHA 2.3 158 TLS_RSA_WITH_AES_128_GCM_SHA256 5.0 159 TLS_RSA_WITH_AES_128_CBC_SHA 2.3 160 TLS_RSA_WITH_AES_256_CBC_SHA 2.3 161 SSL_RSA_WITH_3DES_EDE_CBC_SHA 2.3 (Deprecated in 5.0) 162 SSL_RSA_WITH_RC4_128_SHA 2.3 163 SSL_RSA_WITH_RC4_128_MD5 2.3 (Deprecated in 5.0) 164 ``` 165 166 * **Okio updated to 1.0.1.** 167 168 ``` 169 <dependency> 170 <groupId>com.squareup.okio</groupId> 171 <artifactId>okio</artifactId> 172 <version>1.0.1</version> 173 </dependency> 174 ``` 175 176 * **New APIs to permit easy certificate pinning.** Be warned, certificate 177 pinning is dangerous and could prevent your application from trusting your 178 server! 179 180 * **Cache improvements.** This release fixes some severe cache problems 181 including a bug where the cache could be corrupted upon certain access 182 patterns. We also fixed a bug where the cache was being cleared due to a 183 corrupted journal. We've added APIs to configure a request's `Cache-Control` 184 headers, and to manually clear the cache. 185 186 * **Request cancellation fixes.** This update fixes a bug where synchronous 187 requests couldn't be canceled by tag. This update avoids crashing when 188 `onResponse()` throws an `IOException`. That failure will now be logged 189 instead of notifying the thread's uncaught exception handler. We've added a 190 new API, `Call.isCanceled()` to check if a call has been canceled. 191 192 * New: Update `MultipartBuilder` to support content length. 193 * New: Make it possible to mock `OkHttpClient` and `Call`. 194 * New: Update to h2-14 and hpack-9. 195 * New: OkHttp includes a user-agent by default, like `okhttp/2.1.0-RC1`. 196 * Fix: Handle response code `308 Permanent Redirect`. 197 * Fix: Don't skip the callback if a call is canceled. 198 * Fix: Permit hostnames with underscores. 199 * Fix: Permit overriding the content-type in `OkApacheClient`. 200 * Fix: Use the socket factory for direct connections. 201 * Fix: Honor `OkUrlFactory` APIs that disable redirects. 202 * Fix: Don't crash on concurrent modification of `SPDY` SPDY settings. 203 204 ## Version 2.0.0 205 206 This release commits to a stable 2.0 API. Read the 2.0.0-RC1 changes for advice 207 on upgrading from 1.x to 2.x. 208 209 _2014-06-21_ 210 211 * **API Change**: Use `IOException` in `Callback.onFailure()`. This is 212 a source-incompatible change, and is different from OkHttp 2.0.0-RC2 which 213 used `Throwable`. 214 * Fix: Fixed a caching bug where we weren't storing rewritten request headers 215 like `Accept-Encoding`. 216 * Fix: Fixed bugs in handling the SPDY window size. This was stalling certain 217 large downloads 218 * Update the language level to Java 7. (OkHttp requires Android 2.3+ or Java 7+.) 219 220 ## Version 2.0.0-RC2 221 222 _2014-06-11_ 223 224 This update fixes problems in 2.0.0-RC1. Read the 2.0.0-RC1 changes for 225 advice on upgrading from 1.x to 2.x. 226 227 * Fix: Don't leak connections! There was a regression in 2.0.0-RC1 where 228 connections were neither closed nor pooled. 229 * Fix: Revert builder-style return types from OkHttpClient's timeout methods 230 for binary compatibility with OkHttp 1.x. 231 * Fix: Don't skip client stream 1 on SPDY/3.1. This fixes SPDY connectivity to 232 `https://google.com`, which doesn't follow the SPDY/3.1 spec! 233 * Fix: Always configure NPN headers. This fixes connectivity to 234 `https://facebook.com` when SPDY and HTTP/2 are both disabled. Otherwise an 235 unexpected NPN response is received and OkHttp crashes. 236 * Fix: Write continuation frames when HPACK data is larger than 16383 bytes. 237 * Fix: Don't drop uncaught exceptions thrown in async calls. 238 * Fix: Throw an exception eagerly when a request body is not legal. Previously 239 we ignored the problem at request-building time, only to crash later with a 240 `NullPointerException`. 241 * Fix: Include a backwards-compatible `OkHttp-Response-Source` header with 242 `OkUrlFactory `responses. 243 * Fix: Don't include a default User-Agent header in requests made with the Call 244 API. Requests made with OkUrlFactory will continue to have a default user 245 agent. 246 * New: Guava-like API to create headers: 247 248 ``` 249 Headers headers = Headers.of(name1, value1, name2, value2, ...). 250 ``` 251 252 * New: Make the content-type header optional for request bodies. 253 * New: `Response.isSuccessful()` is a convenient API to check response codes. 254 * New: The response body can now be read outside of the callback. Response 255 bodies must always be closed, otherwise they will leak connections! 256 * New: APIs to create multipart request bodies (`MultipartBuilder`) and form 257 encoding bodies (`FormEncodingBuilder`). 258 259 ## Version 2.0.0-RC1 260 261 _2014-05-23_ 262 263 OkHttp 2 is designed around a new API that is true to HTTP, with classes for 264 requests, responses, headers, and calls. It uses modern Java patterns like 265 immutability and chained builders. The API now offers asynchronous callbacks 266 in addition to synchronous blocking calls. 267 268 #### API Changes 269 270 * **New Request and Response types,** each with their own builder. There's also 271 a `RequestBody` class to write the request body to the network and a 272 `ResponseBody` to read the response body from the network. The standalone 273 `Headers` class offers full access to the HTTP headers. 274 275 * **Okio dependency added.** OkHttp now depends on 276 [Okio](https://github.com/square/okio), an I/O library that makes it easier 277 to access, store and process data. Using this library internally makes OkHttp 278 faster while consuming less memory. You can write a `RequestBody` as an Okio 279 `BufferedSink` and a `ResponseBody` as an Okio `BufferedSource`. Standard 280 `InputStream` and `OutputStream` access is also available. 281 282 * **New Call and Callback types** execute requests and receive their 283 responses. Both types of calls can be canceled via the `Call` or the 284 `OkHttpClient`. 285 286 * **URLConnection support has moved to the okhttp-urlconnection module.** 287 If you're upgrading from 1.x, this change will impact you. You will need to 288 add the `okhttp-urlconnection` module to your project and use the 289 `OkUrlFactory` to create new instances of `HttpURLConnection`: 290 291 ``` 292 // OkHttp 1.x: 293 HttpURLConnection connection = client.open(url); 294 295 // OkHttp 2.x: 296 HttpURLConnection connection = new OkUrlFactory(client).open(url); 297 ``` 298 299 * **Custom caches are no longer supported.** In OkHttp 1.x it was possible to 300 define your own response cache with the `java.net.ResponseCache` and OkHttp's 301 `OkResponseCache` interfaces. Both of these APIs have been dropped. In 302 OkHttp 2 the built-in disk cache is the only supported response cache. 303 304 * **HttpResponseCache has been renamed to Cache.** Install it with 305 `OkHttpClient.setCache(...)` instead of `OkHttpClient.setResponseCache(...)`. 306 307 * **OkAuthenticator has been replaced with Authenticator.** This new 308 authenticator has access to the full incoming response and can respond with 309 whichever followup request is appropriate. The `Challenge` class is now a 310 top-level class and `Credential` is replaced with a utility class called 311 `Credentials`. 312 313 * **OkHttpClient.getFollowProtocolRedirects() renamed to 314 getFollowSslRedirects()**. We reserve the word _protocol_ for the HTTP 315 version being used (HTTP/1.1, HTTP/2). The old name of this method was 316 misleading; it was always used to configure redirects between `https://` and 317 `http://` schemes. 318 319 * **RouteDatabase is no longer public API.** OkHttp continues to track which 320 routes have failed but this is no exposed in the API. 321 322 * **ResponseSource is gone.** This enum exposed whether a response came from 323 the cache, network, or both. OkHttp 2 offers more detail with raw access to 324 the cache and network responses in the new `Response` class. 325 326 * **TunnelRequest is gone.** It specified how to connect to an HTTP proxy. 327 OkHttp 2 uses the new `Request` class for this. 328 329 * **Dispatcher** is a new class to manages the queue of asynchronous calls. It 330 implements limits on total in-flight calls and in-flight calls per host. 331 332 #### Implementation changes 333 334 * Support Android `TrafficStats` socket tagging. 335 * Drop authentication headers on redirect. 336 * Added support for compressed data frames. 337 * Process push promise callbacks in order. 338 * Update to http/2 draft 12. 339 * Update to HPACK draft 07. 340 * Add ALPN support. Maven will use ALPN on OpenJDK 8. 341 * Update NPN dependency to target `jdk7u60-b13` and `Oracle jdk7u55-b13`. 342 * Ensure SPDY variants support zero-length DELETE and POST. 343 * Prevent leaking a cache item's InputStreams when metadata read fails. 344 * Use a string to identify TLS versions in routes. 345 * Add frame logger for HTTP/2. 346 * Replacing `httpMinorVersion` with `Protocol`. Expose HTTP/1.0 as a potential protocol. 347 * Use `Protocol` to describe framing. 348 * Implement write timeouts for HTTP/1.1 streams. 349 * Avoid use of SPDY stream ID 1, as that's typically used for UPGRADE. 350 * Support OAuth in `Authenticator`. 351 * Permit a dangling semicolon in media type parsing. 352 353 ## Version 1.6.0 354 355 _2014-05-23_ 356 357 * Offer bridges to make it easier to migrate from OkHttp 1.x to OkHttp 2.0. 358 This adds `OkUrlFactory`, `Cache`, and `@Deprecated` annotations for APIs 359 dropped in 2.0. 360 361 ## Version 1.5.4 362 363 _2014-04-14_ 364 365 * Drop ALPN support in Android. There's a concurrency bug in all 366 currently-shipping versions. 367 * Support asynchronous disconnects by breaking the socket only. This should 368 prevent flakiness from multiple threads concurrently accessing a stream. 369 370 ## Version 1.5.3 371 372 _2014-03-29_ 373 374 * Fix bug where the Content-Length header was not always dropped when 375 following a redirect from a POST to a GET. 376 * Implement basic support for `Thread.interrupt()`. OkHttp now checks 377 for an interruption before doing a blocking call. If it is interrupted, 378 it throws an `InterruptedIOException`. 379 380 ## Version 1.5.2 381 382 _2014-03-17_ 383 384 * Fix bug where deleting a file that was absent from the `HttpResponseCache` 385 caused an IOException. 386 * Fix bug in HTTP/2 where our HPACK decoder wasn't emitting entries in 387 certain eviction scenarios, leading to dropped response headers. 388 389 ## Version 1.5.1 390 391 _2014-03-11_ 392 393 * Fix 1.5.0 regression where connections should not have been recycled. 394 * Fix 1.5.0 regression where transparent Gzip was broken by attempting to 395 recover from another I/O failure. 396 * Fix problems where spdy/3.1 headers may not have been compressed properly. 397 * Fix problems with spdy/3.1 and http/2 where the wrong window size was being 398 used. 399 * Fix 1.5.0 regression where conditional cache responses could corrupt the 400 connection pool. 401 402 403 ## Version 1.5.0 404 405 _2014-03-07_ 406 407 408 ##### OkHttp no longer uses the default SSL context. 409 410 Applications that want to use the global SSL context with OkHttp should configure their 411 OkHttpClient instances with the following: 412 413 ```java 414 okHttpClient.setSslSocketFactory(HttpsURLConnection.getDefaultSSLSocketFactory()); 415 ``` 416 417 A simpler solution is to avoid the shared default SSL socket factory. Instead, if you 418 need to customize SSL, do so for your specific OkHttpClient instance only. 419 420 ##### Synthetic headers have changed 421 422 Previously OkHttp added a synthetic response header, `OkHttp-Selected-Transport`. It 423 has been replaced with a new synthetic header, `OkHttp-Selected-Protocol`. 424 425 ##### Changes 426 427 * New: Support for `HTTP-draft-09/2.0`. 428 * New: Support for `spdy/3.1`. Dropped support for `spdy/3`. 429 * New: Use ALPN on Android platforms that support it (4.4+) 430 * New: CacheControl model and parser. 431 * New: Protocol selection in MockWebServer. 432 * Fix: Route selection shouldn't use TLS modes that we know will fail. 433 * Fix: Cache SPDY responses even if the response body is closed prematurely. 434 * Fix: Use strict timeouts when aborting a download. 435 * Fix: Support Shoutcast HTTP responses like `ICY 200 OK`. 436 * Fix: Don't unzip if there isn't a response body. 437 * Fix: Don't leak gzip streams on redirects. 438 * Fix: Don't do DNS lookups on invalid hosts. 439 * Fix: Exhaust the underlying stream when reading gzip streams. 440 * Fix: Support the `PATCH` method. 441 * Fix: Support request bodies on `DELETE` method. 442 * Fix: Drop the `okhttp-protocols` module. 443 * Internal: Replaced internal byte array buffers with pooled buffers ("OkBuffer"). 444 445 446 ## Version 1.3.0 447 448 _2014-01-11_ 449 450 * New: Support for "PATCH" HTTP method in client and MockWebServer. 451 * Fix: Drop `Content-Length` header when redirected from POST to GET. 452 * Fix: Correctly read cached header entries with malformed header names. 453 * Fix: Do not directly support any authentication schemes other than "Basic". 454 * Fix: Respect read timeouts on recycled connections. 455 * Fix: Transmit multiple cookie values as a single header with delimiter. 456 * Fix: Ensure `null` is never returned from a connection's `getHeaderFields()`. 457 * Fix: Persist proper `Content-Encoding` header to cache for GZip responses. 458 * Fix: Eliminate rare race condition in SPDY streams that would prevent connection reuse. 459 * Fix: Change HTTP date formats to UTC to conform to RFC2616 section 3.3. 460 * Fix: Support SPDY header blocks with trailing bytes. 461 * Fix: Allow `;` as separator for `Cache-Control` header. 462 * Fix: Correct bug where HTTPS POST requests were always automatically buffered. 463 * Fix: Honor read timeout when parsing SPDY headers. 464 465 466 ## Version 1.2.1 467 468 _2013-08-23_ 469 470 * Resolve issue with 'jar-with-dependencies' artifact creation. 471 * Fix: Support empty SPDY header values. 472 473 474 ## Version 1.2.0 475 476 _2013-08-11_ 477 478 * New APIs on OkHttpClient to set default timeouts for connect and read. 479 * Fix bug when caching SPDY responses. 480 * Fix a bug with SPDY plus half-closed streams. (thanks kwuollett) 481 * Fix a bug in `Content-Length` reporting for gzipped streams in the Apache 482 HTTP client adapter. (thanks kwuollett) 483 * Work around the Alcatel `getByInetAddress` bug (thanks k.kocel) 484 * Be more aggressive about testing pooled sockets before reuse. (thanks 485 warpspin) 486 * Include `Content-Type` and `Content-Encoding` in the Apache HTTP client 487 adapter. (thanks kwuollett) 488 * Add a media type class to OkHttp. 489 * Change custom header prefix: 490 491 ``` 492 X-Android-Sent-Millis is now OkHttp-Sent-Millis 493 X-Android-Received-Millis is now OkHttp-Received-Millis 494 X-Android-Response-Source is now OkHttp-Response-Source 495 X-Android-Selected-Transport is now OkHttp-Selected-Transport 496 ``` 497 * Improve cache invalidation for POST-like requests. 498 * Bring MockWebServer into OkHttp and teach it SPDY. 499 500 501 ## Version 1.1.1 502 503 _2013-06-23_ 504 505 * Fix: ClassCastException when caching responses that were redirected from 506 HTTP to HTTPS. 507 508 509 ## Version 1.1.0 510 511 _2013-06-15_ 512 513 * Fix: Connection reuse was broken for most HTTPS connections due to a bug in 514 the way the hostname verifier was selected. 515 * Fix: Locking bug in SpdyConnection. 516 * Fix: Ignore null header values (for compatibility with HttpURLConnection). 517 * Add URLStreamHandlerFactory support so that `URL.openConnection()` uses 518 OkHttp. 519 * Expose the transport ("http/1.1", "spdy/3", etc.) via magic request headers. 520 Use `X-Android-Transports` to write the preferred transports and 521 `X-Android-Selected-Transport` to read the negotiated transport. 522 523 524 ## Version 1.0.2 525 526 _2013-05-11_ 527 528 * Fix: Remove use of Java 6-only APIs. 529 * Fix: Properly handle exceptions from `NetworkInterface` when querying MTU. 530 * Fix: Ensure MTU has a reasonable default and upper-bound. 531 532 533 ## Version 1.0.1 534 535 _2013-05-06_ 536 537 * Correct casing of SSL in method names (`getSslSocketFactory`/`setSslSocketFactory`). 538 539 540 ## Version 1.0.0 541 542 _2013-05-06_ 543 544 Initial release. 545 546
