World · Cybersecurity
Cloudflare expands Tunnel URL normalization
Source announcement: 2026-11-12 · Event date: 2026-11-12
Cloudflare announced an update to how URL paths are matched against access rules in Tunnel connections. Version 2026.11.0 extends normalization to semicolon-delimited path parameters.
Scope of Access validation
The change applies to ingress rules requiring Cloudflare Access validation. Processing takes place before deciding which rule matches the request; the URL path sent to the origin server is unchanged. Configurations without rules requiring Access validation are unaffected.
Default activation date changed
Cloudflare moved the date when normalization will become enabled by default in new cloudflared releases from 25 January 2027 to 8 February 2027. The setting is currently disabled by default. This schedule does not mean that the feature automatically switched on today for all existing connections.
Quad Bilişim commentary
The update shows how access control works alongside URL interpretation. Distinguishing the path used to select a rule from the path forwarded to the origin server is important for understanding the announcement’s scope.
Sources and verification
Cloudflare: Tunnel URL normalization announcement
News facts were verified against the primary source. Quad Bilişim commentary is editorial opinion, not a manufacturer statement or measured performance result. The image is original and representative.