{"record":{"id":"b7f794bfa1511f79","repo":"remix-run/remix","slug":"invalid-bypass-pattern-json-stringify-pattern-b7f794","errorCode":null,"errorMessage":"invalid bypass pattern ${JSON.stringify(pattern)}: tail wildcards require a name","messagePattern":"invalid bypass pattern (.+?): tail wildcards require a name","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cop-middleware/src/lib/cop.ts","lineNumber":301,"sourceCode":"      `invalid bypass pattern ${JSON.stringify(pattern)}: empty wildcards are not allowed`,\n    )\n  }\n\n  if (wildcardName === '$') {\n    throw new Error(\n      `invalid bypass pattern ${JSON.stringify(pattern)}: \"{$}\" is not supported in cop-middleware`,\n    )\n  }\n\n  if (wildcardName.endsWith('...')) {\n    if (!isLastSegment) {\n      throw new Error(\n        `invalid bypass pattern ${JSON.stringify(pattern)}: tail wildcards must be last`,\n      )\n    }\n\n    if (wildcardName.length === 3) {\n      throw new Error(\n        `invalid bypass pattern ${JSON.stringify(pattern)}: tail wildcards require a name`,\n      )\n    }\n\n    return { type: 'rest' }\n  }\n\n  return { type: 'wildcard' }\n}\n\nfunction matchesBypassPattern(pattern: BypassPattern, context: RequestContext): boolean {\n  if (pattern.method != null && pattern.method !== context.method) {\n    return false\n  }\n\n  let pathname = context.url.pathname\n  let hasTrailingSlash = pathname.length > 1 && pathname.endsWith('/')\n  let normalizedPathname =","sourceCodeStart":283,"sourceCodeEnd":319,"githubUrl":"https://github.com/remix-run/remix/blob/9696913134be3a4423513d2775f7b31d6917c049/packages/cop-middleware/src/lib/cop.ts#L283-L319","documentation":"parseBypassSegment throws when a tail wildcard has no name, i.e. the segment is '{...}'. Tail wildcards require a name like '{rest...}' even though the name is currently not used for capture, because bare '{...}' is ambiguous with malformed syntax.","triggerScenarios":"addInsecureBypassPattern('/assets/{...}') — a segment whose wildcard name is exactly the '...' suffix with nothing before it (wildcardName.length === 3).","commonSituations":"Using glob-style '/assets/**' thinking '*' or bare '...' is supported; shorthand habits from path-to-regexp or glob libraries.","solutions":["Name the tail wildcard: '/assets/{path...}' instead of '/assets/{...}'","Do not use glob '*' or '**' syntax; use the {name...} form"],"exampleFix":"// before\ncop.addInsecureBypassPattern('/assets/{...}')\n// after\ncop.addInsecureBypassPattern('/assets/{path...}')","handlingStrategy":"validation","validationCode":"if (pattern.includes('{...}')) throw new Error('tail wildcard needs a name, e.g. {path...}')","typeGuard":"const hasNoAnonymousTail = (p: string) => !p.includes('{...}')","tryCatchPattern":null,"preventionTips":["Use {name...} form exclusively; never glob '*'/'**' syntax"],"tags":["cop-middleware","bypass-pattern","wildcard","validation"],"backgroundTag":"invalid-path-pattern","analyzedSha":"9696913134be3a4423513d2775f7b31d6917c049","analyzedAt":"2026-08-27T19:55:01.024Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}