Skip to content
← Changelog
fixed

The Cloudflare Worker paywall now judges the path your origin will serve

From planned work to a release note The public record separates future intent from behavior that shipped on a stated date. Release record 01 Roadmap Intent 02 Product Shipped 03 Release note Dated From planned work to a release note The public record separates future intent from behavior that shipped on a stated date. Release record 01 Roadmap Intent 02 Product Shipped 03 Release note Dated
From planned work to a release note The public record separates future intent from behavior that shipped on a stated date.

The site-middleware Worker decodes the request path, collapses repeated slashes and resolves dot segments before it matches your paid routes, and it tests both the raw and the decoded form. A request such as /blog%2Fpost can no longer slip past a /blog/* paywall. A paid fetch asks your origin for the decoded path. The setup guide now binds the Worker to the whole host, because Cloudflare's own route matcher does not decode an encoded slash. An optional CASE_INSENSITIVE_ORIGIN setting covers origins that ignore letter case.

This note records shipped behavior as of . Planned work remains on the public roadmap until release.