Starting from version 2026.10.0, Cloudflare Tunnel can normalize URLs before matching ingress rules. This improves security for tunnels with rules that require Cloudflare Access validation. The URL path sent to your origin stays the same.
In three months, starting 2027-01-25, new cloudflared releases will turn on URL normalization by default. Test your path-based routing before that date, as this change may affect which ingress rule matches a request. Configurations without rules requiring Access validation are unaffected.
This setting is currently off by default. To turn it on, run:
cloudflared tunnel --disable-path-normalization=false run <TUNNEL_NAME_OR_UUID>Alternatively, set TUNNEL_DISABLE_PATH_NORMALIZATION=false on each cloudflared replica and restart it.
For more information, refer to ingress matching and Access validation at the origin.
Source: Cloudflare
