nodejs
diff --git a/‎lib/internal/http.js‎
Lines changed: 8 additions & 2 deletions b/‎lib/internal/http.js‎
Lines changed: 8 additions & 2 deletions
diff --git a/‎test/client-proxy/test-https-proxy-request-auth-failure.mjs‎
Lines changed: 3 additions & 0 deletions b/‎test/client-proxy/test-https-proxy-request-auth-failure.mjs‎
Lines changed: 3 additions & 0 deletions
@@ -99,7 +99,7 @@ function ipToInt(ip) {
 /**
  * Represents the proxy configuration for an agent. The built-in http and https agent
  * implementation have one of this when they are configured to use a proxy.
- * @property {string} href - Full URL of the proxy server.
+ * @property {string} href - Proxy server URL with credentials redacted.
  * @property {string} protocol - Proxy protocol used to talk to the proxy server.
  * @property {string|undefined} auth - proxy-authorization header value, if username or password is provided.
  * @property {Array<string>} bypassList - List of hosts to bypass the proxy.
@@ -115,7 +115,13 @@ class ProxyConfig {
     }
     const { hostname, port, protocol, username, password } = parsedURL;
 
-    this.href = proxyUrl;
+    if (username || password) {
+      parsedURL.username = '';
+      parsedURL.password = '';
+      this.href = parsedURL.href;
+    } else {
+      this.href = proxyUrl;
+    }
     this.protocol = protocol;
 
     if (username || password) {
 
@@ -53,6 +53,9 @@ const { code, signal, stderr } = await runProxiedRequest({
 // The proxy client should get an error from proxy authentication failure.
 // Since the process exits cleanly but with an error, check for any error output
 assert.match(stderr, /407 Proxy Authentication Required/);
+assert.match(stderr, /via http:\/\/localhost:\d+\/?/);
+assert.doesNotMatch(stderr, /baduser/);
+assert.doesNotMatch(stderr, /badpass/);
 assert.strictEqual(code, 0);
 assert.strictEqual(signal, null);