cloudflare / cloudflare/developer-platform

Workers Routes matching does not work with orange-clouded/proxied/O2O DNS

Open
#16 3 comments 0 reactions 0 assignees View on GitHub
awaiting-response:cloudflare
Dominant language
No language data
Stars
1
Forks
0
PR merge metrics
No merged PRs in 30d

Description

### What versions & operating system are you using?

```
System:
OS: macOS 26.1
CPU: (10) arm64 Apple M1 Max
Memory: 446.03 MB / 32.00 GB
Shell: 5.9 - /bin/zsh
Binaries:
Node: 22.17.1 - /Users/timkelty/.nvm/versions/node/v22.17.1/bin/node
npm: 10.9.2 - /Users/timkelty/.nvm/versions/node/v22.17.1/bin/npm
pnpm: 8.15.4 - /opt/homebrew/bin/pnpm
npmPackages:
@cloudflare/unenv-preset: ^2.4.1 => 2.7.9
@cloudflare/vitest-pool-workers: ^0.10.5 => 0.10.5
wrangler: ^4.26.0 => 4.46.0
```

### Please provide a link to a minimal reproduction

https://github.com/timkelty/reprocase-cloudflare-workers-routes

### Describe the Bug

When a DNS record is O2O, worker routes matching does _not_ work as expected. In this case, the _only_ pattern that seems to match is `*/*`.

## Cloudflare Account A (SaaS customer)

### DNS

```
mysite.com CNAME gateway.saasprovider.com (proxy status: proxied)
```

----------

## Cloudflare Account B (SaaS provider)

### Workers

Note: in reality, these workers routes are not set via wrangler, but I'm showing it that way to simplify. The behavior is the same.

#### `gateway_worker`

```
{
"routes": [
{
"pattern": "gateway.saasprovider.com",
"custom_domain": true
}
]
}
```

#### `gateway_worker_beta`

```
{
"routes": [
{
"pattern": "mysite.com/*",
"zone_id": ""
}
]
}
```

With this configuration, a request to `https://mysite.com/` will be incorrectly routed to the `gateway_worker`, even though the pattern matches for `gateway_worker_beta`.

The request is routed to `gateway_worker`, only because of the `custom_domain` on the worker. Without it, you'll get a Cloudflare error page.

If the record is _not-proxied_ (gray cloud), it will be routed to `gateway_worker_beta` as expected.

The only way to intercept these orange-clouded requests with a worker route is by using a `*/*` pattern, which in our case is not an option.

Relevant links:
- https://developers.cloudflare.com/cloudflare-for-platforms/workers-for-platforms/get-started/hostname-routing/#orange-to-orange-o2o-behavior
- https://developers.cloudflare.com/workers/configuration/routing/

### Please provide any relevant error logs

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.