Jesse Wilson

We could use MockWebServer on the JVM to validate all platforms. Ktor won't really work cause it won't let us simulate errors.

Ahhhh... I think we should do our own direct binding to browser JS APIs. For MockWebServer... we would connect to it via HTTP!

Executable test case?

I think our action is to not await the end of part delimiter before returning bytes. One further question is whether to do this if the content-length header is absent....

I dug into this and I couldn’t find anything that specifies `Content-Length` as a header in a multipart body. I even stripped out that behavior from OkHttp’s `MultipartBody` class ’cause...

Would you consider forking MultipartReader to specialize it for your use case? I'm reluctant to add non-standard features.

Could hook up dokkaJavadoc for the Maven artifact. https://blog.jetbrains.com/kotlin/2020/08/dokka-preview-based-on-kotlin-1-4-0-rc/

Unclear what action we should take. Note that there’s another potential attack on response headers.

OkHttp caches 301s. Could you provide an executable test case to demonstrate the problem?

Yep. For me the Facebook image redirects with a 302. That redirect isn’t cached but the followup image is. You can hack a very dangerous, very bad interceptor to force...