@@ -0,0 +1,7 @@
+---
+"wrangler": patch
+---
+
+Fix `wrangler dev` remote bindings for `workers.dev` subdomains protected by Access
+
+Running `wrangler dev` with remote bindings on an unpublished worker protected by Access (e.g. using a wildcard on your workers.dev domain) previously failed with a redirect loop. Wrangler now correctly authenticates remote bindings with Access in this situation.
@@ -228,6 +228,7 @@ export class RemoteRuntimeController {
 
 		const accessHeaders = await getAccessHeaders(token.host, {
 			logger,
+			previewToken: token.value,
 		});
 
 		const proxyData: ProxyData = {
 
@@ -13,6 +13,14 @@ const headersCache: Record<string, Record<string, string>> = {};
 
 const usesAccessCache = new Map<string, boolean>();
 
+function buildProbeUrl(domain: string, previewToken?: string): string {
+	const url = new URL(`https://${domain}`);
+	if (previewToken) {
+		url.searchParams.set("cf_workers_preview_token", previewToken);
+	}
+	return url.toString();
+}
+
 /**
  * Clear internal caches. Exported for use in tests only.
  */
@@ -29,20 +37,29 @@ export function clearAccessCaches(): void {
  * A 302 to `cloudflareaccess.com` is the canonical signal. Service-auth-only
  * Access applications return a hard 403 instead and are therefore not detected
  * here — see {@link getAccessHeaders} for how this is handled.
+ *
+ * When `previewToken` is supplied it is added as the `cf_workers_preview_token`
+ * query parameter so the probe activates an unpublished worker's edge-preview
+ * route (otherwise the anonymous probe 404s and Access is never triggered). The
+ * cache is keyed on whether a token was supplied so token-authenticated and
+ * anonymous probes of the same host don't poison each other.
  */
 export async function domainUsesAccess(
 	domain: string,
-	logger: OAuthFlowLogger
+	logger: OAuthFlowLogger,
+	previewToken?: string
 ): Promise<boolean> {
 	logger.debug("Checking if domain has Access enabled:", domain);
 
-	if (usesAccessCache.has(domain)) {
+	const cacheKey = JSON.stringify([domain, Boolean(previewToken)]);
+
+	if (usesAccessCache.has(cacheKey)) {
 		logger.debug(
 			"Using cached Access switch for:",
 			domain,
-			usesAccessCache.get(domain)
+			usesAccessCache.get(cacheKey)
 		);
-		return usesAccessCache.get(domain) ?? false;
+		return usesAccessCache.get(cacheKey) ?? false;
 	}
 	logger.debug("Access switch not cached for:", domain);
 	try {
@@ -51,7 +68,7 @@ export async function domainUsesAccess(
 			controller.abort();
 		}, 1000);
 
-		const output = await fetch(`https://${domain}`, {
+		const output = await fetch(buildProbeUrl(domain, previewToken), {
 			redirect: "manual",
 			signal: controller.signal,
 		});
@@ -60,12 +77,17 @@ export async function domainUsesAccess(
 			output.status === 302 &&
 			output.headers.get("location")?.includes("cloudflareaccess.com")
 		);
-		logger.debug("Caching access switch for:", domain);
-
-		usesAccessCache.set(domain, usesAccess);
+		// A token-bearing probe can miss Access if its preview route isn't live
+		// yet, and refreshed tokens reuse the same host. Only cache positive
+		// results for those probes so a later token is probed again.
+		if (usesAccess || !previewToken) {
+			logger.debug("Caching access switch for:", domain);
+			usesAccessCache.set(cacheKey, usesAccess);
+		}
 		return usesAccess;
 	} catch {
-		usesAccessCache.set(domain, false);
+		// Don't cache errors, or else transient failures will continue to fail forever
+		logger.debug("Access probe failed for:", domain);
 		return false;
 	}
 }
@@ -75,7 +97,10 @@ export async function domainUsesAccess(
  *
  * @param domain The hostname of the Access-protected domain (e.g. `"example.com"`).
  * @param options logger + an `isNonInteractiveOrCI` predicate used to
- *   produce an actionable error in CI; both default to no-op / `false`.
+ *   produce an actionable error in CI (both default to no-op / `false`), plus an
+ *   optional `previewToken` that is added as the `cf_workers_preview_token`
+ *   query parameter when probing for Access and when invoking `cloudflared
+ *   access login`, so detection works on unpublished `<name>.workers.dev` hosts.
  * @returns
  * - Service token headers (`CF-Access-Client-Id` + `CF-Access-Client-Secret`) if env vars are set
  * - A `Cookie: CF_Authorization=...` header if obtained via `cloudflared` (interactive only)
@@ -92,6 +117,12 @@ export async function getAccessHeaders(
 		isNonInteractiveOrCI?: () => boolean;
 		/** Aborts a pending `cloudflared` authorization and kills its process. */
 		signal?: AbortSignal;
+		/**
+		 * Workers preview token forwarded to the Access probe and to
+		 * `cloudflared access login` so detection works on unpublished
+		 * `<name>.workers.dev` hosts.
+		 */
+		previewToken?: string;
 	}
 ): Promise<Record<string, string>> {
 	const logger = options.logger;
@@ -128,7 +159,7 @@ export async function getAccessHeaders(
 		);
 	}
 
-	if (!(await domainUsesAccess(domain, logger))) {
+	if (!(await domainUsesAccess(domain, logger, options.previewToken))) {
 		return {};
 	}
 	logger.debug("Getting Access headers for domain:", domain);
@@ -153,7 +184,22 @@ export async function getAccessHeaders(
 
 	// 3. Interactive: fall back to cloudflared
 	logger.debug("Spawning cloudflared to get Access token for domain:");
-	const output = await spawnCloudflaredAccessLogin(domain, options.signal);
+
+	// Knowledge of the preview token allows you to route to the unpublished
+	// worker (which may have production bindings and production cache) so in some
+	// sense it's a secret.
+	//
+	// During the Access login flow, the preview token may be visible to other
+	// processes on the machine. It will also appear in browser history and may be
+	// sent to third parties like the identity provider. Are these leaks safe?
+	//
+	// I argue yes! The preview worker is protected by Access, or we wouldn't be
+	// trying to log into it. So the preview token is necessary but not sufficient
+	// to reach it.
+	const output = await spawnCloudflaredAccessLogin(
+		buildProbeUrl(domain, options.previewToken),
+		options.signal
+	);
 	if (output.error) {
 		throw new UserError(
 			"To use Wrangler with Cloudflare Access, please install `cloudflared` from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation",
@@ -186,11 +232,13 @@ export async function getAccessHeaders(
  * surface an installation hint.
  */
 function spawnCloudflaredAccessLogin(
-	domain: string,
+	loginTarget: string,
 	signal?: AbortSignal
 ): Promise<{ error?: Error; stdout: string }> {
 	return new Promise((resolve, reject) => {
-		const child = spawn("cloudflared", ["access", "login", domain], { signal });
+		const child = spawn("cloudflared", ["access", "login", loginTarget], {
+			signal,
+		});
 		const stdoutChunks: Buffer[] = [];
 		child.stdout.on("data", (chunk: Buffer) => stdoutChunks.push(chunk));
 		child.stderr.resume();
 
@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { EventEmitter } from "node:events";
+import { http, HttpResponse } from "msw";
 import { setupServer } from "msw/node";
 import {
 	afterAll,
@@ -116,6 +117,77 @@ describe("access", () => {
 				await domainUsesAccess("access-service-auth-only.com", silentLogger)
 			).toBeFalsy();
 		});
+
+		it("forwards the preview token and caches token-authenticated probes separately", async ({
+			expect,
+		}) => {
+			// Simulates an unpublished workers.dev host: the edge only routes the
+			// request (letting the wildcard Access app respond with its 302) once
+			// the preview token activates the edge-preview route. An anonymous
+			// probe 404s and must not poison the token-authenticated result.
+			msw.use(
+				http.get("https://unpublished.workers.dev/", ({ request }) => {
+					const token = new URL(request.url).searchParams.get(
+						"cf_workers_preview_token"
+					);
+					if (!token) {
+						return HttpResponse.json(null, { status: 404 });
+					}
+					return HttpResponse.json(null, {
+						status: 302,
+						headers: { location: "unpublished.cloudflareaccess.com" },
+					});
+				})
+			);
+
+			expect(
+				await domainUsesAccess("unpublished.workers.dev", silentLogger)
+			).toBeFalsy();
+			expect(
+				await domainUsesAccess(
+					"unpublished.workers.dev",
+					silentLogger,
+					"preview-token"
+				)
+			).toBeTruthy();
+		});
+
+		it("re-probes with a later preview token after a token-bearing probe misses Access", async ({
+			expect,
+		}) => {
+			// The first token's preview route isn't live yet, so its probe 404s. A
+			// refreshed token for the same host must be probed rather than reusing
+			// that negative result.
+			msw.use(
+				http.get("https://unpublished.workers.dev/", ({ request }) => {
+					const token = new URL(request.url).searchParams.get(
+						"cf_workers_preview_token"
+					);
+					if (token !== "live-token") {
+						return HttpResponse.json(null, { status: 404 });
+					}
+					return HttpResponse.json(null, {
+						status: 302,
+						headers: { location: "unpublished.cloudflareaccess.com" },
+					});
+				})
+			);
+
+			expect(
+				await domainUsesAccess(
+					"unpublished.workers.dev",
+					silentLogger,
+					"stale-token"
+				)
+			).toBeFalsy();
+			expect(
+				await domainUsesAccess(
+					"unpublished.workers.dev",
+					silentLogger,
+					"live-token"
+				)
+			).toBeTruthy();
+		});
 	});
 
 	describe("getAccessHeaders", () => {
@@ -365,7 +437,37 @@ See https://developers.cloudflare.com/cloudflare-one/access-controls/service-cre
 				});
 				expect(spawn).toHaveBeenCalledWith(
 					"cloudflared",
-					["access", "login", "access-protected.com"],
+					["access", "login", "https://access-protected.com/"],
+					{ signal: undefined }
+				);
+			});
+
+			it("should forward the preview token to cloudflared as a query parameter", async ({
+				expect,
+			}) => {
+				const fake = createFakeProcess();
+				vi.mocked(spawn).mockReturnValueOnce(fake.child);
+
+				const pendingHeaders = getAccessHeaders("access-protected.com", {
+					logger: silentLogger,
+					isNonInteractiveOrCI: () => false,
+					previewToken: "preview-token",
+				});
+				await vi.waitFor(() => {
+					expect(spawn).toHaveBeenCalledOnce();
+				});
+				fake.complete("fetched your token:\n\ntest-access-token\n");
+
+				await expect(pendingHeaders).resolves.toEqual({
+					Cookie: "CF_Authorization=test-access-token",
+				});
+				expect(spawn).toHaveBeenCalledWith(
+					"cloudflared",
+					[
+						"access",
+						"login",
+						"https://access-protected.com/?cf_workers_preview_token=preview-token",
+					],
 					{ signal: undefined }
 				);
 			});
 
@@ -66,6 +66,13 @@ pnpm test:e2e:wrangler
 > You can find your subdomain in the Cloudflare dashboard under **Workers & Pages**.
 > It defaults to `devprod-testing7928.workers.dev` (the CI account).
 
+The Cloudflare Access tests need a self-hosted Access application covering a
+wildcard of Worker names on that subdomain (for example
+`my-access-test-*.<your-subdomain>.workers.dev`) with an interactive-login
+policy. Set `E2E_ACCESS_WORKER_PREFIX=my-access-test-` to run them; otherwise
+they are skipped when `E2E_ACCOUNT_WORKERS_DEV_DOMAIN` is overridden. The CI
+account uses `wrangler-wildcard-test-`.
+
 ### Focusing on a single e2e test file
 
 If you want to run a subset of tests (e.g. just one) while retaining the turborepo cache for the builds of the dependencies, you can provide the list of test files via the `WRANGLER_E2E_TEST_FILE` environment variable.
 
@@ -10,3 +10,19 @@ export const CLOUDFLARE_ACCOUNT_ID = process.env
 export const E2E_ACCOUNT_WORKERS_DEV_DOMAIN =
 	process.env.E2E_ACCOUNT_WORKERS_DEV_DOMAIN ??
 	"devprod-testing7928.workers.dev";
+
+/**
+ * Worker-name prefix covered by a wildcard Cloudflare Access application on
+ * the e2e account's workers.dev subdomain. The CI account has an Access app
+ * for `wrangler-wildcard-test-*.devprod-testing7928.workers.dev`, which
+ * requires an interactive login.
+ *
+ * When running against another account (`E2E_ACCOUNT_WORKERS_DEV_DOMAIN`),
+ * set `E2E_ACCESS_WORKER_PREFIX` to a matching prefix on that account, or the
+ * Access tests are skipped.
+ */
+export const E2E_ACCESS_WORKER_PREFIX =
+	process.env.E2E_ACCESS_WORKER_PREFIX ??
+	(process.env.E2E_ACCOUNT_WORKERS_DEV_DOMAIN === undefined
+		? "wrangler-wildcard-test-"
+		: undefined);
@@ -0,0 +1,68 @@
+import crypto from "node:crypto";
+import { resolve } from "node:path";
+import { describe, it } from "vitest";
+import {
+	CLOUDFLARE_ACCOUNT_ID,
+	E2E_ACCESS_WORKER_PREFIX,
+	E2E_ACCOUNT_WORKERS_DEV_DOMAIN,
+} from "../helpers/account-id";
+import { WranglerE2ETestHelper } from "../helpers/e2e-wrangler-test";
+import { waitForLong } from "../helpers/wait-for";
+
+describe.skipIf(!CLOUDFLARE_ACCOUNT_ID || !E2E_ACCESS_WORKER_PREFIX)(
+	"wrangler dev - remote bindings behind Cloudflare Access",
+	() => {
+		// By default, anonymously probing a never-deployed worker behind a
+		// wildcard Access application triggers a 404 instead of a 302 to
+		// Access. Including an edge-preview token in the URL should make the
+		// request correctly 302. We can't test the full authentication flow
+		// here: service token credentials would authenticate but bypass the
+		// Access probe altogether, so they wouldn't exercise this fix (and
+		// interactive `cloudflared access login` can't work in CI), so we
+		// instead at least test that wrangler correctly identifies Access.
+		it("detects Access on an unpublished Worker's preview host", async ({
+			expect,
+		}) => {
+			const workerName = `${E2E_ACCESS_WORKER_PREFIX}${crypto.randomUUID().slice(0, 8)}`;
+			const helper = new WranglerE2ETestHelper();
+			await helper.seed(resolve(__dirname, "./workers"));
+			await helper.seed({
+				"wrangler.json": JSON.stringify({
+					name: workerName,
+					main: "ai.js",
+					compatibility_date: "2025-05-07",
+					ai: { binding: "AI", remote: true },
+				}),
+			});
+
+			// Precondition: without the preview token, the host isn't recognisably
+			// behind Access. If this returns a 302, the test no longer reproduces
+			// the bug (e.g. the Access app changed or the Worker was deployed).
+			const anonymous = await fetch(
+				`https://${workerName}.${E2E_ACCOUNT_WORKERS_DEV_DOMAIN}/`,
+				{ redirect: "manual" }
+			);
+			expect(anonymous.status).toBe(404);
+
+			// Remove any service-token credentials so Wrangler has to probe for
+			// Access. The e2e process is non-interactive, so detecting Access
+			// produces an actionable error instead of starting `cloudflared`.
+			const worker = helper.runLongLived("wrangler dev", {
+				env: {
+					...process.env,
+					CLOUDFLARE_ACCESS_CLIENT_ID: undefined,
+					CLOUDFLARE_ACCESS_CLIENT_SECRET: undefined,
+				},
+			});
+
+			await waitForLong(
+				() =>
+					expect(worker.currentOutput).toContain(`The domain "${workerName}.`),
+				{ timeout: 60_000 }
+			);
+			expect(worker.currentOutput).toContain(
+				"is behind Cloudflare Access, but no Access Service Token credentials were found"
+			);
+		});
+	}
+);