Please ensure you have read the contribution guide before creating a pull request.

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

• N/A — no existing issue.

2. Or, if no issue exists, describe the change:

Problem:

The dev server (adk web / adk api_server) performs no origin validation at all. cors() is only installed when --allow_origins is passed, and CORS is a response-header mechanism, not a request gate — it never rejects anything. So any page the developer visits while the server is running can drive it: create sessions, run agents, read session/artifact/trace data. Two attacks work today:

• Cross-origin state change. A page on https://evil.com POSTs to http://localhost:8000/run. The browser sends it; the server executes it.
• DNS rebinding. A page on evil.com whose DNS re-resolves to 127.0.0.1 is same-origin to the browser, so it sends no Origin header at all and can GET /apps/.../sessions/.... An Origin check alone cannot see this attack — only the Host header (evil.com:8000) gives it away.

Two smaller bugs fall out of the same code: --allow_origins a,b reached cors() as one opaque string that no origin can ever equal, and the /, /health and /dev-ui routes are registered before app.use(cors(...)), so they bypass it.

Solution:

One middleware, registered before every route in init() (so the dev-UI routes and the A2A routes later mounted by initA2A() are all behind it), backed by a small pure module dev/src/server/origin_check.ts:

• Host allowlist — every request, including GET, must carry a Host matching a static allowlist derived from the address the server actually bound to (localhost:P, 127.0.0.1:P, [::1]:P, the configured --host, and the hosts of any --allow_origins entries). This is the DNS-rebinding defence: it is the only check that sees an attack carrying no Origin. A missing Host fails closed.
• Origin check — a state-changing method (anything outside GET/HEAD/OPTIONS) carrying an Origin must be same-origin or explicitly allowed. Requests with no Origin pass, so curl, the ADK CLI and AdkApiClient are unaffected; this matches the Python dev server's _OriginCheckMiddleware.
• Rejections return 403 with a text/plain body (Forbidden: origin not allowed / Forbidden: host not allowed) and log one warn line naming the offending header, so a developer who trips the gate can tell why.

Design notes:

• The Host allowlist is only enforced for a loopback bind. A wildcard (0.0.0.0) or public bind is legitimately reachable under any number of LAN addresses, so there is no finite set to allow — and the DNS-rebinding threat model is specifically the loopback dev server. adk api_server --host 0.0.0.0 in a container is unaffected, as is the Cloud Run / Agent Engine deploy path (deploy_utils.ts passes --host=0.0.0.0).
• Forwarding headers are never consulted. An untrusted X-Forwarded-Host would let a caller forge the server side of the same-origin comparison. A reverse-proxied or tunnelled setup is declared with --allow_origins https://your-proxy.example instead, which both allows the origin and adds its authority to the Host allowlist. (An earlier draft had a --trust_proxy_headers flag; it was dropped because --allow_origins already covers the case and the flag did not actually work on its own — on the default loopback bind the proxied Origin was still rejected.)
• --allow_origins is now parsed as a comma-separated list and the resulting array is handed to cors(), fixing the multi-origin case. '*' is still passed as the literal string, because cors only emits the wildcard header for that exact value.

Behavioural change, intentional. Three classes of request that used to succeed now get a 403: cross-origin state-changing browser requests; any request to a loopback-bound server carrying a Host outside the allowlist; and requests relying on X-Forwarded-Host to look same-origin. Each has an escape hatch — --allow_origins <origin>, or binding to a non-loopback host.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.

• All unit tests pass locally.

• dev/test/server/origin_check_test.ts — the decision table (buildOriginPolicy, requestRejectionReason), including the DNS-rebinding scenarios ported from adk-python's test_dns_rebinding_protection.py. origin_check.ts is at 100% line and branch coverage.

• dev/test/server/adk_api_server_origin_check_test.ts — the gate end to end through a real AdkApiServer over node:http (undici silently drops a caller-supplied Host, so fetch cannot forge one).

• The existing dev/test/server/adk_api_server_test.ts (45 tests) and the CLI-spawning integration tests pass unmodified, which is the check that the gate does not break the shipped happy paths.

npx vitest run --project unit:dev dev/test/server dev/test/cli/cli_test.ts     # 119 passed
npx vitest run --project integration tests/integration/adk_web/webui_test.ts \
    tests/integration/a2a/basic/a2a_agent_test.ts                             # 3 passed
npm run build -w dev && npx eslint dev/src dev/test && npx prettier --check dev/src dev/test

Manual End-to-End (E2E) Tests:

npm run build -w dev
node dev/dist/esm/cli_entrypoint.js api_server ./tests/integration/adk_web/agent --port 8000

Then, with a wildcard bind — --host 0.0.0.0 --port 8000:

And with --allow_origins 'https://tunnel.example, http://localhost:4200':

Finally, node dev/dist/esm/cli_entrypoint.js web ./tests/integration/adk_web/agent --port 8000: http://localhost:8000/dev-ui loads and a session can be created and messaged exactly as before, and with --allow_origins '*' the response still carries Access-Control-Allow-Origin: *.

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have manually tested my changes end-to-end.
• Any dependent changes have been merged and published in downstream modules.

Additional context

This mirrors the request gate already shipped by the adk-python dev server (_OriginCheckMiddleware and its DNS-rebinding protection); dev/test/server/origin_check_test.ts ports the scenarios from that project's test_dns_rebinding_protection.py.