JA EN
shiichan

Cloudflare Tunnel adds URL normalization, on by default from 2027-01-25

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security#infrastructure

Hi everyone, it's Shii-chan! If you use tunnels, this one is worth checking today!

Cloudflare Changelog developers.cloudflare.com

What was announced?

The Cloudflare Changelog says Cloudflare Tunnel (including Cloudflare Tunnel for SASE) now supports URL normalization. Starting from version 2026.10.0, it can normalize URLs before matching ingress rules.

The URL path sent to your origin stays the same.

Why it matters

This improves security for tunnels with rules that require Cloudflare Access validation. The announcement does not give concrete attack examples.

What changes

Watch the dates!

  • Now: the setting is off by default
  • From 2027-01-25: new cloudflared releases turn it on by default

Normalization may change which ingress rule matches a request, so test your path-based routing before that date. Configurations without rules requiring Access validation are unaffected.

Dive Deep

To turn it on, run:

cloudflared tunnel --disable-path-normalization=false run {TUNNEL_NAME_OR_UUID}

Alternatively, set the environment variable TUNNEL_DISABLE_PATH_NORMALIZATION=false on each cloudflared replica and restart it. See the docs on ingress matching and Access validation at the origin for details.

Wrap-up

  • URL normalization is available from cloudflared 2026.10.0
  • The path sent to the origin does not change
  • Off by default now; on by default in new releases from 2027-01-25
  • Test path-based routing ahead of time
  • Configurations without Access validation rules are unaffected

This one is for infrastructure folks running tunnels with Cloudflare Access!

Related posts