lib: move request specific allocations to the request struct

[bagder]

To make it clearer that they are ephemeral.

[bagder]

@aisle-analyzer

[aisle-research-bot]

🔒 Aisle Security Analysis

✅ We scanned this PR and did not find any security vulnerabilities.

_{Aisle supplements but does not replace security review.}

---

Analyzed PR: #21301 at commit d434bfb

_{Last updated on: 2026-04-13T17:47:59Z}

[Copilot]

Pull request overview

This PR moves per-request HTTP auth header allocations (userpwd / proxyuserpwd) from the long-lived UrlState storage into the request-scoped SingleRequest struct to better reflect their ephemeral nature.

Changes:

• Relocated userpwd and proxyuserpwd fields from data->state.aptr to data->req.
• Updated HTTP/RTSP/auth/proxy code paths to read/write the auth header strings via data->req.*.
• Adjusted cleanup paths to free the relocated allocations on handle close.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
lib/urldata.h	Removes userpwd/proxyuserpwd from UrlState dynamic allocations.
lib/request.h	Adds userpwd/proxyuserpwd to struct SingleRequest.
lib/url.c	Frees the moved request-scoped auth header allocations during Curl_close().
lib/http.c	Uses data->req.* for Basic/Bearer auth headers and when adding auth headers to requests; clears at end of Curl_http().
lib/http_proxy.c	Uses data->req.proxyuserpwd when building CONNECT requests.
lib/http_ntlm.c	Points NTLM auth header allocation at data->req.*.
lib/http_negotiate.c	Stores Negotiate auth header into data->req.*.
lib/http_digest.c	Points Digest auth header allocation at data->req.*.
lib/http_aws_sigv4.c	Stores SigV4 Authorization header into data->req.userpwd.
lib/rtsp.c	Switches RTSP auth header usage/freeing to data->req.userpwd / data->req.proxyuserpwd.
lib/cf-h1-proxy.c	Clears proxy auth header via data->req.proxyuserpwd in proxy tunnel state machine.
lib/cf-h2-proxy.c	Clears proxy auth header via data->req.proxyuserpwd in proxy tunnel state machine.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.