{"record":{"id":"5cdfbbf606d40583","repo":"cloudflare/cloudflared","slug":"hostname-patterns-can-have-at-most-one-wildcard-ch","errorCode":null,"errorMessage":"Hostname patterns can have at most one wildcard character (\"*\") and it can only be used for subdomains, e.g. \"*.example.com\"","messagePattern":"Hostname patterns can have at most one wildcard character \\(\"\\*\"\\) and it can only be used for subdomains, e\\.g\\. \"\\*\\.example\\.com\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/ingress.go","lineNumber":25,"sourceCode":"\t\"regexp\"\n\t\"strconv\"\n\t\"strings\"\n\n\t\"github.com/pkg/errors\"\n\t\"github.com/rs/zerolog\"\n\t\"github.com/urfave/cli/v2\"\n\t\"golang.org/x/net/idna\"\n\n\t\"github.com/cloudflare/cloudflared/config\"\n\t\"github.com/cloudflare/cloudflared/ingress/middleware\"\n\t\"github.com/cloudflare/cloudflared/ipaccess\"\n)\n\nvar (\n\tErrNoIngressRules             = errors.New(\"The config file doesn't contain any ingress rules\")\n\tErrNoIngressRulesCLI          = errors.New(\"No ingress rules were defined in provided config (if any) nor from the cli, cloudflared will return 503 for all incoming HTTP requests\")\n\terrLastRuleNotCatchAll        = errors.New(\"The last ingress rule must match all URLs (i.e. it should not have a hostname or path filter)\")\n\terrBadWildcard                = errors.New(\"Hostname patterns can have at most one wildcard character (\\\"*\\\") and it can only be used for subdomains, e.g. \\\"*.example.com\\\"\")\n\terrHostnameContainsPort       = errors.New(\"Hostname cannot contain a port\")\n\tErrURLIncompatibleWithIngress = errors.New(\"You can't set the --url flag (or $TUNNEL_URL) when using multiple-origin ingress rules\")\n)\n\nconst (\n\tServiceBastion     = \"bastion\"\n\tServiceSocksProxy  = \"socks-proxy\"\n\tServiceWarpRouting = \"warp-routing\"\n)\n\n// FindMatchingRule returns the index of the Ingress Rule which matches the given\n// hostname and path. This function assumes the last rule matches everything,\n// which is the case if the rules were instantiated via the ingress#Validate method.\n//\n// Negative index rule signifies local cloudflared rules (not-user defined).\nfunc (ing Ingress) FindMatchingRule(hostname, path string) (*Rule, int) {\n\t// The hostname might contain port. We only want to compare the host part with the rule\n\thost, _, err := net.SplitHostPort(hostname)","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/ingress.go#L7-L43","documentation":"errBadWildcard is returned when an ingress rule hostname pattern misuses the '*' wildcard. Cloudflared only permits a single wildcard as the leftmost label for subdomain matching, e.g. '*.example.com'. Any other placement or count of '*' is rejected during config validation.","triggerScenarios":"validateHostname finds strings.LastIndex(r.Hostname, \"*\") > 0, i.e. a wildcard appears anywhere other than the first character, or multiple wildcards are present (e.g. 'www.*.example.com', 'a*b.example.com', '*.example.*').","commonSituations":"Users copying wildcard syntax from other proxies (placeholders mid-hostname), typos like '*?.example.com', or attempting multi-level wildcards in the config YAML ingress rules.","solutions":["Move the wildcard to the first character of the hostname: '*.example.com'","Remove extra '*' characters so at most one exists","If you meant a literal hostname, delete the '*' entirely","Re-validate with 'cloudflared tunnel ingress validate' before running"],"exampleFix":"// before\nhostname: \"api.*.example.com\"\n// after\nhostname: \"*.example.com\"","handlingStrategy":"validation","validationCode":"func validHostnamePattern(h string) bool { return h == \"\" || (len(h) > 1 && h[0] == '*' && !strings.Contains(h[1:], \"*\")) || !strings.Contains(h, \"*\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only use '*' as the leftmost label for subdomain matching","Run 'cloudflared tunnel ingress validate' before deploying configs","Never place wildcards mid-hostname or use more than one"],"tags":["config","ingress","hostname","wildcard"],"backgroundTag":"invalid-config-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}