The filter honours the standard {@code Forwarded} header as well as {@code X-Forwarded-*}, so * both are covered. + * + *
This is the path taken when {@code adk.web.backend-url} is unset. Setting it supplies the
+ * prefix directly and the forwarded one is ignored, though the host and scheme still come from
+ * these headers while the filter is enabled.
*/
@SpringBootTest(properties = "server.forward-headers-strategy=framework")
@AutoConfigureMockMvc
diff --git a/dev/src/test/java/com/google/adk/web/BackendUrlRedirectTest.java b/dev/src/test/java/com/google/adk/web/BackendUrlRedirectTest.java
new file mode 100644
index 000000000..79cdc24b7
--- /dev/null
+++ b/dev/src/test/java/com/google/adk/web/BackendUrlRedirectTest.java
@@ -0,0 +1,138 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.adk.web;
+
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
+import org.springframework.test.web.servlet.MockMvc;
+
+/**
+ * With {@code adk.web.backend-url} set, the entry redirect carries the gateway's path prefix on its
+ * own, so a deployment behind a path-stripping proxy needs nothing forwarded from the proxy. The
+ * property governs the path only: host and scheme still come from forwarded headers wherever the
+ * operator has enabled {@code server.forward-headers-strategy}.
+ */
+public class BackendUrlRedirectTest {
+
+ @Nested
+ @SpringBootTest(
+ properties = {
+ "adk.web.backend-url=https://gw.example.com/my-app",
+ // Without this Spring discards the forwarded header, and the test below could not fail if
+ // the redirect stopped ignoring it.
+ "server.forward-headers-strategy=framework"
+ })
+ @AutoConfigureMockMvc
+ class ConfiguredWithTheFilter {
+
+ @ParameterizedTest
+ @ValueSource(strings = {"/", "/dev-ui"})
+ public void devUiEntryPoints_shouldCarryTheConfiguredPrefix(
+ String path, @Autowired MockMvc mockMvc) throws Exception {
+ // No forwarded headers: the configured value is the only thing that knows the prefix.
+ mockMvc
+ .perform(get(path))
+ .andExpect(status().is3xxRedirection())
+ .andExpect(redirectedUrl("/my-app/dev-ui/"));
+ }
+
+ @ParameterizedTest
+ @ValueSource(strings = {"/", "/dev-ui"})
+ public void devUiEntryPoints_shouldNotStackAForwardedPrefix(
+ String path, @Autowired MockMvc mockMvc) throws Exception {
+ // The filter makes this a context path; the configured prefix replaces it.
+ mockMvc
+ .perform(get(path).header("X-Forwarded-Prefix", "/evil"))
+ .andExpect(status().is3xxRedirection())
+ .andExpect(redirectedUrl("http://localhost/my-app/dev-ui/"));
+ }
+
+ @Test
+ public void devUiEntryPoint_forwardedHostAndProto_stillSetTheRedirectsOrigin(
+ @Autowired MockMvc mockMvc) throws Exception {
+ // The configured value supplies the path; host and scheme still come from the headers.
+ mockMvc
+ .perform(
+ get("/")
+ .header("X-Forwarded-Host", "gw.example.com")
+ .header("X-Forwarded-Proto", "https"))
+ .andExpect(status().is3xxRedirection())
+ .andExpect(redirectedUrl("https://gw.example.com/my-app/dev-ui/"));
+ }
+ }
+
+ @Nested
+ @SpringBootTest(properties = "adk.web.backend-url=https://gw.example.com/my-app")
+ @AutoConfigureMockMvc
+ class ConfiguredWithoutTheFilter {
+
+ @Test
+ public void devUiEntryPoint_forwardedHeaders_reachNothingUnderTheShippedStrategy(
+ @Autowired MockMvc mockMvc) throws Exception {
+ // No strategy set, which is what ships: the property supplies the path, these reach nothing.
+ mockMvc
+ .perform(
+ get("/")
+ .header("X-Forwarded-Prefix", "/evil")
+ .header("X-Forwarded-Host", "evil.example.com")
+ .header("Forwarded", "host=evil.example.com;proto=https"))
+ .andExpect(status().is3xxRedirection())
+ .andExpect(redirectedUrl("/my-app/dev-ui/"));
+ }
+ }
+
+ @Nested
+ @SpringBootTest
+ @AutoConfigureMockMvc
+ class UnconfiguredWithoutTheFilter {
+
+ @ParameterizedTest
+ @ValueSource(strings = {"/", "/dev-ui"})
+ public void devUiEntryPoints_shouldRedirectWithoutAPrefix(
+ String path, @Autowired MockMvc mockMvc) throws Exception {
+ mockMvc
+ .perform(get(path))
+ .andExpect(status().is3xxRedirection())
+ .andExpect(redirectedUrl("/dev-ui/"));
+ }
+
+ @ParameterizedTest
+ @ValueSource(strings = {"/", "/dev-ui"})
+ public void devUiEntryPoints_withForwardedHeaders_shouldStillRedirectWithoutAPrefix(
+ String path, @Autowired MockMvc mockMvc) throws Exception {
+ // The shipped default: no forwarded-header strategy is set, so nothing in the request can
+ // reach the redirect.
+ mockMvc
+ .perform(
+ get(path)
+ .header("X-Forwarded-Prefix", "/evil")
+ .header("X-Forwarded-Host", "evil.example.com")
+ .header("Forwarded", "host=evil.example.com;proto=https"))
+ .andExpect(status().is3xxRedirection())
+ .andExpect(redirectedUrl("/dev-ui/"));
+ }
+ }
+}
diff --git a/dev/src/test/java/com/google/adk/web/config/BackendUrlTest.java b/dev/src/test/java/com/google/adk/web/config/BackendUrlTest.java
new file mode 100644
index 000000000..73cbbfa3d
--- /dev/null
+++ b/dev/src/test/java/com/google/adk/web/config/BackendUrlTest.java
@@ -0,0 +1,158 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.adk.web.config;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
+import java.util.List;
+import org.junit.jupiter.api.Test;
+import org.slf4j.LoggerFactory;
+
+/**
+ * One reading of {@code adk.web.backend-url}. The value the dev UI is served and the prefix its
+ * entry redirect carries come from the same parse, so they cannot disagree.
+ */
+public class BackendUrlTest {
+
+ private static final String CONFIGURED = "https://gw.example.com/my-app";
+
+ @Test
+ public void unset_isEmptyEverywhere() {
+ for (String in : new String[] {null, "", " "}) {
+ assertThat(BackendUrl.from(in).value()).isEmpty();
+ assertThat(BackendUrl.from(in).pathPrefix()).isEmpty();
+ }
+ }
+
+ @Test
+ public void absoluteUrl_isServedAndSuppliesThePrefix() {
+ BackendUrl url = BackendUrl.from(CONFIGURED);
+
+ assertThat(url.value()).isEqualTo(CONFIGURED);
+ assertThat(url.pathPrefix()).isEqualTo("/my-app");
+ }
+
+ @Test
+ public void trailingSlashes_areStripped() {
+ // The UI appends paths starting with a slash, so a trailing one would yield //run_live.
+ assertThat(BackendUrl.from(CONFIGURED + "/").value()).isEqualTo(CONFIGURED);
+ assertThat(BackendUrl.from(CONFIGURED + "///").pathPrefix()).isEqualTo("/my-app");
+ assertThat(BackendUrl.from(" " + CONFIGURED + " ").value()).isEqualTo(CONFIGURED);
+ }
+
+ @Test
+ public void hostWithoutPath_hasNoPrefix() {
+ assertThat(BackendUrl.from("https://gw.example.com").pathPrefix()).isEmpty();
+ assertThat(BackendUrl.from("https://gw.example.com/").pathPrefix()).isEmpty();
+ }
+
+ @Test
+ public void percentEncoding_isKept() {
+ // This goes into a Location header, so decoding would re-encode wrongly and %2F would
+ // turn into a path separator.
+ assertThat(BackendUrl.from("https://gw.example.com/my%20app").pathPrefix())
+ .isEqualTo("/my%20app");
+ assertThat(BackendUrl.from("https://gw.example.com/a%2Fb").pathPrefix()).isEqualTo("/a%2Fb");
+ }
+
+ @Test
+ public void doubledSlash_doesNotBecomeAHost() {
+ // "//my-app/dev-ui/" is protocol-relative: a browser resolves it to the host "my-app".
+ assertThat(BackendUrl.from("https://gw.example.com//my-app").pathPrefix()).isEqualTo("/my-app");
+ }
+
+ @Test
+ public void unusableValue_isStillServedButWarns() {
+ // Never silently discarded, because it is an explicit setting.
+ assertThat(BackendUrl.from("/my-app").value()).isEqualTo("/my-app");
+ assertThat(BackendUrl.from("HTTPS://gw.example.com/x").value())
+ .isEqualTo("HTTPS://gw.example.com/x");
+ assertThat(BackendUrl.from("http://").value()).isEqualTo("http://");
+
+ assertThat(warningsFor("/my-app")).hasSize(1);
+ assertThat(warningsFor("/my-app").get(0)).contains("/my-app");
+ assertThat(warningsFor("HTTPS://gw.example.com/x")).hasSize(1);
+ assertThat(warningsFor("http://")).hasSize(1);
+ }
+
+ @Test
+ public void slashOnly_isNotEmptiedByTheSlashTrim() {
+ // Emptying this would make the served value fall back to whatever the bundled config says,
+ // silently losing an explicit setting.
+ assertThat(BackendUrl.from("/").value()).isEqualTo("/");
+ assertThat(BackendUrl.from("/").pathPrefix()).isEmpty();
+ }
+
+ @Test
+ public void queryFragmentOrUserinfo_yieldsNoPrefixAndWarns() {
+ // The UI appends onto the value, so these would land in the middle of every request.
+ for (String in :
+ new String[] {
+ "https://gw.example.com/a/b?q=1",
+ "https://gw.example.com/a/b#f",
+ "https://user:pass@gw.example.com/my-app"
+ }) {
+ assertThat(BackendUrl.from(in).pathPrefix()).isEmpty();
+ assertThat(warningsFor(in)).hasSize(1);
+ }
+ }
+
+ @Test
+ public void valueWithoutALeadingSlashPath_yieldsNoPrefix() {
+ // "gw.example.com/dev-ui/" in a Location is a relative redirect, i.e. a guess.
+ assertThat(BackendUrl.from("gw.example.com").pathPrefix()).isEmpty();
+ assertThat(warningsFor("gw.example.com")).hasSize(1);
+ }
+
+ @Test
+ public void unparseableValue_yieldsNoPrefixAndWarns() {
+ // The old split lost the prefix here silently; one parse now warns instead.
+ String malformed = "https://gw.example.com/my app";
+
+ assertThat(BackendUrl.from(malformed).value()).isEqualTo(malformed);
+ assertThat(BackendUrl.from(malformed).pathPrefix()).isEmpty();
+ assertThat(warningsFor(malformed)).hasSize(1);
+ }
+
+ @Test
+ public void usableValue_doesNotWarn() {
+ assertThat(warningsFor(CONFIGURED)).isEmpty();
+ assertThat(warningsFor(CONFIGURED + "/")).isEmpty();
+ assertThat(warningsFor("")).isEmpty();
+ }
+
+ /** The WARN messages logged while interpreting {@code configured}. */
+ private static List