http: clear the proxy credentials as well on port or scheme change

[bagder]

Add test 2009 to verify switching between proxies with credentials when the switch is driven by a redirect

Reported-by: Dwij Mehta

[Copilot]

Pull request overview

This PR fixes credential handling across redirects where a scheme/port change causes libcurl to switch proxies, ensuring proxy credentials from the previous proxy do not “stick” to the next proxy. It also adds new regression tests to cover proxy switching with and without explicitly provided proxy credentials.

Changes:

• Add Curl_reset_userpwd() helper and use it during pretransfer setup and redirect-follow auth clearing.
• Update redirect-follow logic to reset proxy credentials when clearing auth on scheme/port changes.
• Add new tests test2009/test2010 plus a small tweak in test795, and register new tests in tests/data/Makefile.am.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
lib/transfer.c	Introduces Curl_reset_userpwd() and reuses it in Curl_pretransfer().
lib/transfer.h	Exposes Curl_reset_userpwd() for internal callers (e.g., HTTP redirect handling).
lib/http.c	Calls Curl_reset_userpwd() when clearing auth on redirect port/scheme changes.
tests/data/test2009	New test: ensures env-provided proxy creds don’t leak when redirect switches from http_proxy to https_proxy.
tests/data/test2010	New test: ensures --proxy-user creds still apply across a proxy switch driven by redirect.
tests/data/test795	Replaces a hard-coded base64 blob with %b64[...]b64% equivalent for IMAP AUTH PLAIN.
tests/data/Makefile.am	Registers the new tests in the test case list.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bagder]

augment review

[augmentcode]

🤖 Augment PR Summary

Summary: This PR hardens HTTP redirect handling so proxy credentials do not leak when the effective proxy changes due to a redirect.

Changes:

• Introduces `Curl_reset_userpwd()` and `Curl_reset_proxypwd()` helpers to restore credentials from option strings.
• Refactors `Curl_pretransfer()` to use the new helpers instead of duplicating credential-reset logic.
• Updates `Curl_http_follow()` to reset proxy credentials during follow processing so stale proxy auth is not reused across scheme/port changes.
• Adds new testcases (2009–2011) covering redirects that switch between `http_proxy` and `https_proxy`, with and without explicit proxy-user options.
• Updates the tests Makefile to include the new testcases in the suite.

Technical notes: The new tests validate that Proxy-Authorization is not sent to a different proxy after a cross-scheme redirect, while still being sent when explicitly configured via --proxy-user.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 3 suggestions posted.

Comment augment review to trigger a new review at any time.