request: cleanup the auth headers on soft rest as well

To avoid the risk them lingering around.

Follow-up to 3512b673ddc54074676d

Closes #21311

diff --git a/lib/request.c b/lib/request.c
index 32499d7f6b9d55dc47d0b791ab90b4c48f1c8735..a76c1a9b6cb72d0b3d2233b0c175a41acd401468 100644 (file)
--- a/lib/request.c
+++ b/lib/request.c
@@ -65,6 +65,11 @@ CURLcode Curl_req_soft_reset(struct SingleRequest *req,
   req->httpversion = 0;
   req->sendbuf_hds_len = 0;
 
+  curlx_safefree(req->userpwd);
+#ifndef CURL_DISABLE_PROXY
+  curlx_safefree(req->proxyuserpwd);
+#endif
+
   result = Curl_client_start(data);
   if(result)
     return result;