Skip to content

fix(web): make root->dev-ui redirect reverse-proxy-prefix-aware - #1458

Open
luisSilva1234 wants to merge 1 commit into
google:mainfrom
luisSilva1234:fix/redirect-prefix-aware
Open

fix(web): make root->dev-ui redirect reverse-proxy-prefix-aware#1458
luisSilva1234 wants to merge 1 commit into
google:mainfrom
luisSilva1234:fix/redirect-prefix-aware

Conversation

@luisSilva1234

@luisSilva1234 luisSilva1234 commented Aug 26, 2026

Copy link
Copy Markdown

Fixes #1457

Summary

AdkWebServer.addViewControllers() redirects "/" to the root-relative path "/dev-ui". Root-relative sendRedirect() targets are left untouched by Spring's own reverse-proxy support (ForwardedHeaderFilter only applies X-Forwarded-Prefix to context-relative targets, via StringUtils.applyRelativePath, which it skips whenever the target already starts with /). So when this app is deployed behind a path-stripping reverse proxy, the browser follows an unprefixed Location header the proxy has no route for, and the dev UI 404s.

This PR makes the redirect context-relative ("dev-ui") instead, so server.forward-headers-strategy=framework + an X-Forwarded-Prefix header from the proxy can correctly restore the prefix.

Behavior for the non-proxied/local case

No change: RedirectView's contextRelative handling only prepends the context path when the target starts with / (so a context-relative target is passed through as-is), and the servlet container's own relative-URL resolution for sendRedirect still resolves "dev-ui" against the current request path "/" to "/dev-ui".

Test plan

Added AdkWebServerReverseProxyTest, covering both cases with server.forward-headers-strategy=framework enabled:

  • Without any forwarded headers: redirect is unchanged ("dev-ui") — confirmed ForwardedHeaderFilter doesn't wrap the response at all when the request carries no Forwarded/X-Forwarded-* headers, so this matches the property being off entirely.
  • With X-Forwarded-Prefix: /my-app-prefix: redirect becomes http://.../my-app-prefix/dev-ui, confirming the fix.

Also updated AdkWebServerUITest.rootShouldRedirectToDevUi to expect the new context-relative value (MockHttpServletResponse.sendRedirect stores the location verbatim with no resolution, so this assertion needed to change from "/dev-ui" to "dev-ui").

Verified locally end-to-end (JDK 17, as required by this repo):

mvn -pl dev -am test

BUILD SUCCESS, 1776 core tests + all dev module tests (including the new and updated ones) pass, 0 failures.

mvn compile was also run to confirm google-java-format is happy with the new file (auto-formatted cleanly, no manual formatting issues found).

@google-cla

google-cla Bot commented Aug 26, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@luisSilva1234
luisSilva1234 force-pushed the fix/redirect-prefix-aware branch from ec5a866 to 08be647 Compare August 26, 2026 08:22
AdkWebServer.addViewControllers() redirects "/" to the root-relative
path "/dev-ui". A root-relative sendRedirect() target is left untouched
by Spring's own reverse-proxy support (ForwardedHeaderFilter only
applies X-Forwarded-Prefix to context-relative targets, via
StringUtils.applyRelativePath, which it skips whenever the target
already starts with "/"). So when this app is deployed behind a
path-stripping reverse proxy, the browser follows an unprefixed
Location header the proxy has no route for, and the dev UI 404s.

Making the redirect context-relative ("dev-ui") instead lets
server.forward-headers-strategy=framework + an X-Forwarded-Prefix
header from the proxy correctly restore the prefix, with no behavior
change for the common local/non-proxied case (RedirectView's
contextRelative handling, and the servlet container's own relative-URL
resolution, both still resolve "dev-ui" from "/" to "/dev-ui").

Adds AdkWebServerReverseProxyTest, a dedicated test class (separate
from AdkWebServerUITest since server.forward-headers-strategy is a
server-wide property) covering both the no-forwarded-headers baseline
and the X-Forwarded-Prefix case that this fix specifically enables.
@luisSilva1234
luisSilva1234 force-pushed the fix/redirect-prefix-aware branch from 08be647 to 4681eff Compare August 26, 2026 08:56
@hemasekhar-p hemasekhar-p self-assigned this Aug 26, 2026
@hemasekhar-p

Copy link
Copy Markdown
Contributor

Hi @luisSilva1234, thank you for your contribution and We appreciate you taking the time to submit this pull request. Since this is your first contribution, could you please complete the Google CLA so that we can proceed with the review?

@hemasekhar-p hemasekhar-p added the waiting on reporter Waiting for reaction by reporter. Failing that, maintainers will eventually closed it as stale. label Aug 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

waiting on reporter Waiting for reaction by reporter. Failing that, maintainers will eventually closed it as stale.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

AdkWebServer's root->dev-ui redirect breaks behind a path-stripping reverse proxy

3 participants