Static Asset `_headers` URL Hostname Wildcard Not Matching

[sibi361]

What versions & operating system are you using?

wrangler@4.23.0, Node v22.12.0, Linux (x64)

Please provide a link to a minimal reproduction

https://github.com/sibi361/mre-headers

Describe the Bug

Background

I am following this Cloudflare docs guide to prevent my Cloudflare Worker's workers.dev URL from showing in search results. This worker primarily serves static assets and is deployed at https://mre-headers.sleepless.workers.dev/.

I am applying the X-Matched-Path custom header using the _headers file placed in the Wrangler config's assets.directory i.e. public/_headers:

/*
  X-Matched-Path: Case 1 - /*

https://*.workers.dev/*
  X-Matched-Path: Case 2 - https://*.workers.dev/*

https://*.sleepless.workers.dev/*
  X-Matched-Path: Case 3 - https://*.sleepless.workers.dev/*

https://mre-headers.*.workers.dev/*
  X-Matched-Path: Case 4 - https://mre-headers.*.workers.dev/*

https://mre-headers.sleepless.workers.dev/*
  X-Matched-Path: Case 5 - https://mre-headers.sleepless.workers.dev/*

Expected Behavior

Upon visiting any path on the deployed worker's workers.dev domain, the response headers served by the asset worker must include five X-Matched-Path headers, i.e. cases 1 till 5.

Current Behavior

Upon visiting /, only cases 1 and 5 are getting triggered. This is confirmed by the fact that there are only two x-matched-path headers with the values Case 1 - /* and Case 5 - https://mre-headers.sleepless.workers.dev/*.

Cases 2, 3 and 4 are not getting matched despite a hostname wildcard example having being provided in the documentation.

Please provide any relevant error logs

HTTP/2 200
date: Sun, 06 Jul 2025 12:50:30 GMT
content-type: text/html
content-encoding: zstd
cf-cache-status: HIT
cache-control: public, max-age=0, must-revalidate
x-matched-path: Case 1 - /*
x-matched-path: Case 5 - https://mre-headers.sleepless.workers.dev/*
vary: Accept-Encoding
server: cloudflare
cf-ray: 95af3a6cac57e15a-MRS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=126472&min_rtt=126092&rtt_var=47556&sent=5&recv=8&lost=0&retrans=0&sent_bytes=1843&recv_bytes=2827&delivery_rate=11103&cwnd=250&unsent_bytes=0&cid=331f55a30e951fdc&ts=176&x=0"
X-Firefox-Spdy: h2

[petebacondarwin]

Did you see this in the docs?

You may only include a single splat in the URL.

I think this is working as described.

[sibi361]

Hi @petebacondarwin, thank you for the clarification regarding the usage of splats in the URL. I now understand that only zero or one splat, i.e. * can be used in a URL pattern.

Despite that I am not sure if this issue can be closed because of this contradicting example on the same docs page which uses two splats:

Prevent your workers.dev URLs showing in search results

https://*.workers.dev/*
  X-Robots-Tag: noindex

[petebacondarwin]

Yes you are correct that the documentation is inaccurate. That needs to be fix in the cloudflare-docs repository.
I created an issue there: cloudflare/cloudflare-docs#23472

[sibi361]

Thanks @petebacondarwin for creating the issue.

Is there any chance I can raise a PR to fix the same?

[petebacondarwin]

That would be magic!

[sibi361]

I've a PR at cloudflare/cloudflare-docs#23541.