From 7ec25148c06b049d3252172ff17fae85b19c54c9 Mon Sep 17 00:00:00 2001
From: alhudz <al.hudz.k@gmail.com>
Date: Wed, 10 Jun 2026 18:30:13 +0530
Subject: [PATCH] digest: flush proxy state on proxy or credential change

Closes #21951
---
 lib/http_digest.c | 39 ++++++++++++++++++++++++---------------
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/lib/http_digest.c b/lib/http_digest.c
index 6949b3bd0d..0e10700407 100644
--- a/lib/http_digest.c
+++ b/lib/http_digest.c
@@ -62,6 +62,27 @@ CURLcode Curl_input_digest(struct Curl_easy *data,
   return Curl_auth_decode_digest_http_message(header, digest);
 }
 
+/* Flush the Digest state if it was created for a different origin or with
+   different credentials than the ones now in use, then link the current
+   ones. */
+static void digest_flush_stale(struct digestdata *digest,
+                               struct Curl_peer *peer,
+                               struct Curl_creds *creds)
+{
+  bool flush = FALSE;
+  if(digest->origin && !Curl_peer_same_destination(peer, digest->origin))
+    flush = TRUE;
+  else if(digest->creds && !Curl_creds_same(creds, digest->creds))
+    flush = TRUE;
+
+  if(flush)
+    /* flush Digest state */
+    Curl_auth_digest_cleanup(digest);
+
+  Curl_peer_link(&digest->origin, peer);
+  Curl_creds_link(&digest->creds, creds);
+}
+
 CURLcode Curl_output_digest(struct Curl_easy *data,
                             bool proxy,
                             const unsigned char *request,
@@ -88,29 +109,17 @@ CURLcode Curl_output_digest(struct Curl_easy *data,
     return CURLE_NOT_BUILT_IN;
 #else
     digest = &data->state.proxydigest;
+    digest_flush_stale(digest, data->conn->http_proxy.peer,
+                       data->conn->http_proxy.creds);
     allocuserpwd = &data->req.hd_proxy_auth;
     creds = data->conn->http_proxy.creds;
     authp = &data->state.authproxy;
 #endif
   }
   else {
-    bool flush = FALSE;
     DEBUGASSERT(data->conn->origin);
-    if(data->state.digest.origin &&
-       !Curl_peer_same_destination(data->conn->origin,
-                                   data->state.digest.origin))
-      flush = TRUE;
-    else if(data->state.digest.creds &&
-            !Curl_creds_same(data->state.creds, data->state.digest.creds))
-      flush = TRUE;
-
-    if(flush)
-      /* flush host Digest state */
-      Curl_auth_digest_cleanup(&data->state.digest);
-
-    Curl_peer_link(&data->state.digest.origin, data->conn->origin);
-    Curl_creds_link(&data->state.digest.creds, data->state.creds);
     digest = &data->state.digest;
+    digest_flush_stale(digest, data->conn->origin, data->state.creds);
     allocuserpwd = &data->req.hd_auth;
     creds = data->state.creds;
     authp = &data->state.authhost;