--- a/src/jdk.incubator.httpclient/share/classes/jdk/incubator/http/Stream.java	Fri Jan 26 11:08:42 2018 +0000
+++ b/src/jdk.incubator.httpclient/share/classes/jdk/incubator/http/Stream.java	Fri Jan 26 16:46:52 2018 +0000
@@ -481,7 +481,9 @@
             h.setHeader("content-length", Long.toString(contentLength));
         }
         setPseudoHeaderFields();
-        OutgoingHeaders<Stream<T>> f = new OutgoingHeaders<>(h, request.getUserHeaders(), this);
+        HttpHeaders sysh = filter(h);
+        HttpHeaders userh = filter(request.getUserHeaders());
+        OutgoingHeaders<Stream<T>> f = new OutgoingHeaders<>(sysh, userh, this);
         if (contentLength == 0) {
             f.setFlag(HeadersFrame.END_STREAM);
             endStreamSent = true;
@@ -489,6 +491,20 @@
         return f;
     }
 
+    private HttpHeaders filter(HttpHeaders headers) {
+        if (connection().isTunnel()) {
+            boolean needsFiltering = headers
+                    .firstValue("proxy-authorization")
+                    .isPresent();
+            // don't send proxy-* headers to the target server.
+            if (needsFiltering) {
+                return ImmutableHeaders.of(headers.map(),
+                        Utils.NO_PROXY_HEADER);
+            }
+        }
+        return headers;
+    }
+
     private void setPseudoHeaderFields() {
         HttpHeadersImpl hdrs = requestPseudoHeaders;
         String method = request.method();