The mistake is not obvious, but quite a usual one: the "generic" greedy dot matching pattern followed with a series of optional subpatterns (patterns that can match an empty string).
The \..*\/.*\/([^\/?]*)\/?$ pattern matches like this: \..* matches a . and then any 0+ chars as many as possible, then backtracking starts for \/ to match a / that is the rightmost / in the string (the last one), then .*\/ matches again any 0+ chars as many as possible and then makes the engine backtrack even further and forces it to discard the previously found / and re-match the / that is before to accommodate for another rightmost / in the string. Then, finally comes ([^\/?]*)\/?$, but the previous .*\/ already matched in the URL with / at the end, and the regex index is at the string end. So, since ([^\/?]*) can match 0+ chars other than ? and / and \/? can match 0 / chars, they both match empty strings at the end of the string, and $ calls it a day and the regex engine returns a valid match with an empty value in Group 1.
Get rid of greedy dots, use a
'~([^\/?]+)\/?$~'
See the regex demo
Details
-
([^\/?]+) - Capturing group 1: one or more chars other than ? and /
-
\/? - 1 or 0 / chars
-
$ - at the end of the string.
