[wrangler] Validate header rules reject multiple wildcards

[penalosa]

Fixes #9739.

This PR adds validation in parseHeaders() to reject header rules that:

• Contain multiple wildcards (e.g., https://*.pages.dev/*)
• Combine a wildcard with a :splat placeholder (e.g., https://*.pages.dev/:splat)

Previously, such rules were silently accepted during parsing but failed at runtime due to JavaScript regex duplicate named capture group errors. The rule would be quietly filtered out, causing unexpected behavior.

Also, previously when paths were invalid, we would confusingly throw the error message 'Path should come before header', because from the perspective of the parser, the invalid path wasn't there anymore and it was just a bare header.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: Error messages are self-explanatory and guide users to fix the issue

[changeset-bot]

🦋 Changeset detected

Latest commit: b844442

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[claude]

Claude finished @penalosa's task —— View job

---

Changeset Review

Reviewed changeset file: .changeset/validate-header-rules-wildcards.md

Todo List:

• Read changeset guidelines
• Review changeset file
• Validate against criteria
• Check for cute animal images
• Post findings

---

✅ All changesets look good

The changeset properly:

• Uses patch version type (appropriate for a bug fix that adds validation)
• Has a clear, descriptive title following imperative style
• Provides meaningful explanation of the issue and the fix
• Contains no h1/h2/h3 headers
• Does not introduce new analytics
• Is not a dependabot change
• Is not an experimental feature

The description clearly explains what was broken (silent runtime failures) and how this fix improves the user experience (early validation with clear error messages).

---

[github-actions]

Changeset Review

File: .changeset/reject-multiple-wildcards-headers.md

Package: @cloudflare/workers-shared
Version Type: patch

Review

Criterion	Status	Notes
Version Type	✅	Patch is appropriate for this bug fix (was failing silently, now warns)
Changelog Quality	✅	Clear description of the change and previous behavior
Markdown Headers	✅	No h1/h2/h3 headers found
Analytics	✅	No analytics changes
Dependabot	✅	Not a dependency update
Experimental Features	✅	N/A - not an experimental feature change

Summary

The changeset clearly describes:

• What is being warned about (headers rules with multiple wildcards or wildcard + :splat)
• Examples of problematic patterns
• The previous behavior (silent failure during dev)

---

✅ All changesets look good

[pkg-pr-new]

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@12276

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@12276

miniflare

npm i https://pkg.pr.new/miniflare@12276

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@12276

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@12276

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@12276

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@12276

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@12276

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@12276

wrangler

npm i https://pkg.pr.new/wrangler@12276

commit: b844442

[workers-devprod]

Codeowners approval required for this PR:

• @cloudflare/deploy-config
• ✅ @cloudflare/wrangler

Show detailed file reviewers

• packages/workers-shared/utils/configuration/parseHeaders.ts: [@cloudflare/deploy-config]
• packages/workers-shared/utils/tests/parseHeaders.invalid.test.ts: [@cloudflare/deploy-config]

[workers-devprod]

Codeowners approval required for this PR:

• @cloudflare/deploy-config
• ✅ @cloudflare/wrangler

Show detailed file reviewers

• packages/workers-shared/utils/configuration/parseHeaders.ts: [@cloudflare/deploy-config]
• packages/workers-shared/utils/tests/parseHeaders.invalid.test.ts: [@cloudflare/deploy-config]

[petebacondarwin]

Codeowners bypass

[workers-devprod]

Codeowners reviews satisfied