Cloudflare Tunnel, Cloudflare Tunnel for SASE - Cloudflare Tunnel supports URL normalization

<p>Starting from version <code>2026.10.0</code>, <a href="https://developers.cloudflare.com/tunnel/">Cloudflare Tunnel</a> can normalize URLs before matching ingress rules. This improves security for tunnels with rules that require Cloudflare Access validation. The URL path sent to your origin stays the same.</p> <p>In three months, starting 2027-01-25, new <code>cloudflared</code> releases will turn on URL normalization by default. Test your path-based routing before that date, as this change may affect which ingress rule matches a request. Configurations without rules requiring Access validation are unaffected.</p> <p>This setting is currently off by default. To turn it on, run:</p> <figure class="nb-code-figure" data-nb-lang="sh"><pre class="astro-code astro-code-themes github-light github-dark nb-shiki-c6xiwz" tabindex="0" data-language="sh" data-nb-lang="sh"><code><span class="line"><span class="nb-shiki-1t8gfj">cloudflared</span><span class="nb-shiki-mdbnqw"> tunnel</span><span class="nb-shiki-dzsirb"> --disable-path-normalization=false</span><span class="nb-shiki-mdbnqw"> run</span><span class="nb-shiki-1itgoe"> &lt;</span><span class="nb-shiki-mdbnqw">TUNNEL_NAME_OR_UUI</span><span class="nb-shiki-140thh">D</span><span class="nb-shiki-1itgoe">&gt;</span></span></code></pre></figure> <p>Alternatively, set <code>TUNNEL_DISABLE_PATH_NORMALIZATION=false</code> on each <code>cloudflared</code> replica and restart it.</p> <p>For more information, refer to <a href="https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/configuration-file/#how-traffic-is-matched">ingress matching</a> and <a href="https://developers.cloudflare.com/tunnel/reference/origin-parameters/#access">Access validation at the origin</a>.</p>