AdkWebServer's root->dev-ui redirect breaks behind a path-stripping reverse proxy
@hemasekhar-p ci sta già lavorando.
Dal 26/8/2026.
Valutazione
Questa issue non è ancora stata valutata.
Descrizione
Description
AdkWebServer.addViewControllers() redirects "/" to the root-relative path "/dev-ui":
registry.addRedirectViewController("/", "/dev-ui");
When this app is deployed behind a reverse proxy that strips a path prefix before forwarding the request (a common pattern for platform-managed multi-tenant gateways, e.g. Kubernetes Gateway API HTTPRoute with a URLRewrite/ReplacePrefixMatch filter), the browser follows this redirect to an unprefixed path the proxy has no route for, and the dev UI 404s.
Why this can't be fixed by the app alone with standard Spring mechanisms
Spring's own reverse-proxy support (server.forward-headers-strategy=framework, which installs ForwardedHeaderFilter) is specifically designed to solve exactly this class of problem via the X-Forwarded-Prefix header — but it only works for context-relative redirect targets (ones that do not start with /). I traced this through ForwardedHeaderExtractingResponse#sendRedirect:
path = (path.startsWith(FOLDER_SEPARATOR) ? path :
StringUtils.applyRelativePath(this.request.getRequestURI(), path));
Root-relative targets (starting with /, as "/dev-ui" does) skip the applyRelativePath branch entirely — the one place X-Forwarded-Prefix awareness would apply — so the prefix is never spliced back in, no matter how the proxy is configured.
Proposed fix
Change the redirect target to be context-relative instead of root-relative:
registry.addRedirectViewController("/", "dev-ui");
I verified this doesn't change behavior for the common local/non-proxied case: RedirectView's contextRelative handling only prepends the context path when the target starts with / (so a context-relative target like "dev-ui" is passed through as-is), and the servlet container's own relative-URL resolution for sendRedirect still resolves "dev-ui" against the current request path "/" to "/dev-ui". It does additionally allow server.forward-headers-strategy=framework + an X-Forwarded-Prefix header to correctly restore a proxy's path prefix, fixing the reverse-proxy case with zero app-specific workaround code.
I've opened a PR with this one-line fix plus the corresponding test update: (link to follow)
Environment
- adk-java: current
main(verified against commite8b1c20) - Encountered while deploying a Java ADK agent behind a Kubernetes Gateway API
HTTPRoutethat strips a per-app path prefix
- Lingua principale
- Java
- Stelle
- 1.7k
- Fork
- 421
- Merge medio
- 3g 8h
- PR unite (30g)
- 36
Guida per i contributori
Apri la guida per i contributori
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Altre issue di google/adk-java
-
needs review
Difficoltà 5/5 Più di una settimana Idoneità per principianti 35/100
-
needs review
-
needs review
-
needs review
-
needs review
Tutte le issue di google/adk-java
Issue simili
-
executions.Query — startDate and timeRange filters are sent with inverted comparison operators Apertaarea/plugin
Difficoltà 2/5 1-3 ore Idoneità per principianti 75/100
kestra-io/plugin-kestra#190 ·
-
litertlm-android AAR ships no consumer ProGuard rules → "mid == null" SIGABRT in minified apps Aperta
Difficoltà 2/5 1-3 ore Idoneità per principianti 70/100
google-ai-edge/LiteRT-LM#3739 ·
-
bug
Difficoltà 2/5 1-3 ore Idoneità per principianti 75/100
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 75/100
integra-team-red/meet-map#249 ·
-
[Studio][Bug] Cancelled create-user dialog keeps the password and admin switch for the next attempt Aperta
Difficoltà 2/5 1-3 ore Idoneità per principianti 75/100
apache/rocketmq-dashboard#5064 ·