ISTIO 1.6 traffic redirection

Networking
1

We have two namespaces, dev and sandbox. the same service is deployed in both the namespaces. there are two virtual services in both the namespaces that redirect the traffic to the individual namespaces.
Here are they
name: external-id-profile-vs
namespace: sandbox

kind: VirtualService
apiVersion: networking.istio.io/v1alpha3
metadata:
  name: external-id-profile-vs
  namespace: sandbox
  selfLink: >-
    /apis/networking.istio.io/v1alpha3/namespaces/sandbox/virtualservices/external-id-profile-vs
  uid: 6fe9706e-6493-4542-89d6-bc6f9116a197
  resourceVersion: '31449980'
  generation: 6
  creationTimestamp: '2020-08-07T14:39:59Z'
spec:
  hosts:
    - external-id-profile.sandbox.svc.cluster.local
    - dev.mydomain.com
  gateways:
    - ingress-gateway.default.svc.cluster.local
  http:
    - match:
     - match:
        - uri:
            exact: /member/search/v1/external-id/profile
          headers:
            x-customappname:
              exact: SANDBOX
     name: route-external-id-profile-1
      route:
        - destination:
            host: external-id-profile.sandbox.svc.cluster.local
            port:
              number: 9082
            subset: v1
          weight: 100

Here is the another virtual service that is there in the dev namespace

name: external-id-profile-vs
namespace: dev

kind: VirtualService
apiVersion: networking.istio.io/v1alpha3
metadata:
  name: external-id-profile-vs
  namespace: dev
  selfLink: >-
    /apis/networking.istio.io/v1alpha3/namespaces/dev/virtualservices/external-id-profile-vs
  uid: 464fb281-90f6-4880-b02e-14ffa84dd50f
  resourceVersion: '31450148'
  generation: 10
  creationTimestamp: '2020-07-06T16:33:54Z'
spec:
  hosts:
    - external-id-profile.dev.svc.cluster.local
    - dev.mydomain.com
  gateways:
    - ingress-gateway.default.svc.cluster.local
  http:
    - match:
        - uri:
            exact: /member/search/v1/external-id/profile
      name: route-external-id-profile-3
      route:
        - destination:
            host: external-id-profile.dev.svc.cluster.local
            port:
              number: 9082
            subset: v1
          weight: 100

yet when we give the following curl the traffic is redirected to the dev namespace instead of the sandbox.

curl --location --request POST 'https://dev.mydomain.com/member/search/v1/external-id/profile' \
--header 'x-customappname: SANDBOX' \
--header 'Content-Type: application/json' \
--data-raw '{
"firstName": "dummy",
"lastName": "dodo",
"gender": "M"
}'

As per the documentation ISTIO would take both into consideration before redirecting traffic.

What am I doing wrong?

2

Figured it out.
ISTIO routing rules are greedy, hence in the first case when it matches the uri it does not check to see if there are secondary options available. Introducing additional similar header in the dev correctly redirects traffic now.