Path Normalization at the Tunnel Edge: Why a Route Matches on localhost but Not Through a Tunnel
Your /admin route works on localhost:8080 . Through the tunnel, //admin returns something different, /public/../admin behaves differently again, and a rule you assumed was guarding the path never seems to fire. Nothing is wrong with your app. Several components are each parsing the same path with different rules, and a tunnel adds one more parser to the chain. That chain is about to change. Starting 2027-01-25 , new cloudflared releases will turn on URL normalization by default, which Cloudflare says may change which ingress rule matches a request. This guide explains what changes, what doesn't, how path-confusion auth bypasses work, and how to test your own routing before the default flips. Quick summary cloudflared 2026.10.0 and later can normalize the URL path before matching ingress rules. It is off by default today and on by default in new releases from 2027-01-25. Cloudflare scopes the change to tunnels with ingress rules that require Cloudflare Access validatio...
