Error: invalid rule (A path rule cannot contain anything after * token)

[jacobcarrington]

Describe the bug

I'm getting the following error from my __header file when running netlify dev

Error: invalid rule (A path rule cannot contain anything after * token)

Configuration

the content of my __header file looks like this:

/*
  X-Frame-Options: SAMEORIGIN
  X-XSS-Protection: 1; mode=block
  cache-control: max-age=31536000
  cache-control: no-cache
  cache-control:  no-store
  cache-control: must-revalidate
/*.js
  cache-control: max-age=31536000
/*.css
  cache-control: max-age=31536000
/*.woff
  cache-control: max-age=31536000

adding to https://play.netlify.com/headers, this is deemed valid

Expected behavior

I would expect netlify dev to run and apply these header rules

CLI Output

netlify dev fail with the following error; Error: invalid rule (A path rule cannot contain anything after * token)

[jacobcarrington]

Another fairly common configuration that passes validation but fails to build

/**/*.html
  Access-Control-Allow-Origin: *
  X-Frame-Options: SAMEORIGIN
  X-XSS-Protection: 1; mode=block
  cache-control: max-age=0
  cache-control: no-cache
  cache-control: must-revalidate

/sw.js
   cache-control: public
   cache-control:  max-age=0
   cache-control: must-revalidate

/page-data/*
   cache-control: public
   cache-control:  max-age=0
   cache-control: must-revalidate

[igregson]

I'm also hitting this. As a workaround I'm simply not copying over the _headers file when using netlify dev, but this adds extra workflow complexity that I'd like to avoid.

Any updates?

[LandGod]

I am encountering this issue as well. Very annoying since we've never had a problem with our headers on Netlify itself; only with with CLI.

Here is our current "_headers" file contents:

/*
    Access-Control-Allow-Origin: *
    Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

# ******** Non-hashed static assets ********
# These we're ok caching for 7 days on a local machine and 7 days on Edge. (see above)

/img-gen/*
  Cache-Control: public, s-max-age=604800, max-age=604800
/images*
  Cache-Control: public, s-max-age=604800, max-age=604800

/fonts/*
  Cache-Control: public, s-max-age=604800, max-age=604800

/favicon/*
  Cache-Control: public, s-max-age=604800, max-age=604800

# ******** Hashed assets ********
# These we're ok to cache for 1 year on a local machine and 1 year on Edge (see above)

/*.css
  Cache-Control: public, s-max-age=31536000, max-age=31536000
  
/*.js
  Cache-Control: public, s-max-age=31536000, max-age=31536000

The resulting error message says the failure is specifically on the line: /*.css

Again, never had a build fail on this file and we've been using it for quite a while unchanged, yet CLI fails instantly with it.

[jacobcarrington]

Interesting, this doesn't seem to be an issue with the TOML file header config so I've switched and stopped using the __header file.

[LandGod]

Interesting, this doesn't seem to be an issue with the TOML file header config so I've switched and stopped using the __header file.

Same here. After moving the header rules into my netlify.toml the issue has disappeared.