A Proxy URL’s UserInfo Is Not WebProxy.Credentials

WebProxy’s URI constructor selects an endpoint; it does not populate Credentials from that URI’s user information. For an application-validated HTTP proxy URL:

var uri = new Uri(proxyUrl);
var endpoint = new UriBuilder(uri)
{
    UserName = "",
    Password = ""
};

var proxy = new System.Net.WebProxy(endpoint.Uri);

if (uri.UserInfo.Length > 0)
{
    var parts = uri.UserInfo.Split(new[] { ':' }, 2);
    var username = Uri.UnescapeDataString(parts[0]);
    var password = parts.Length == 2
        ? Uri.UnescapeDataString(parts[1])
        : "";

    proxy.Credentials =
        new System.Net.NetworkCredential(username, password);
}

proxyUrl is the supplied proxy URL, not the website URL. Uri parses its authority, while UriBuilder removes the user information from the endpoint stored in WebProxy.

Split at the first literal colon before decoding the components. This preserves an encoded colon within the username and keeps additional password colons in the password. Decode each component once; do not Base64-encode the password as a substitute for URL escaping.

Finally, assign proxy to the intended HTTP handler before that handler starts requests. Constructing the object alone does not change another client’s routing policy.