connection credentials origin

[icing]

When tying credentials to a connection (NTLM, Negotiate) also link the origin the credentials are for. This prevents a connection reuse with the same credentials, but intended for another origin.

The mis-reuse could happen for a forwarding proxy and NTLM (although, in the mind of the person writing this, it is an insane setup).

[Copilot]

Pull request overview

This PR aims to prevent incorrect connection reuse when authentication mechanisms (notably NTLM and Negotiate/SPNEGO) bind credentials to a connection, by additionally binding the origin those credentials are intended for. This addresses a potential mis-reuse scenario with forwarding proxies where the same proxy connection could otherwise be reused for a different origin while still carrying connection-bound auth state.

Changes:

• Add conn->creds_origin to track which origin the connection-bound credentials apply to.
• Unlink/free creds_origin with the connection and when resetting auth state.
• Enforce origin+creds matching for NTLM connection reuse and bind origin when NTLM/Negotiate ties creds to the connection.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
lib/urldata.h	Adds creds_origin to struct connectdata to track the origin associated with connection-bound credentials.
lib/url.c	Unlinks creds_origin on connection free; updates NTLM connection-reuse matching to also check creds_origin; links creds_origin when setting connection-level creds.
lib/http_ntlm.c	Clears creds_origin/creds on NTLM handshake rejection; binds origin+creds when NTLM ties credentials to the connection.
lib/http_negotiate.c	Clears creds_origin when resetting Negotiate; binds origin+creds when Negotiate ties credentials to the connection.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.