APM sends local favicon.ico to client instead of fetching it from the backend

In this case you'd like the favicon to be transmitted to the client ONLY once they are succesfully authenticated? Something like this should work (for LTM+APM mode), it says basically "If there is no session and the user is requesting favicon, then send a 404 instead of the APM favicon."

I'm not exactly sure if the best bet is a 404 or something different, but because you don't know in advance what backend host should get the favicon request, you're forced to send some static content or error.

Please also note that this irule uses the "ACCESS::restrict_irule_events disable" command which causes the HTTP_REQUEST event to fire upon each access, rather than the default behavior of only firing on the non-built-in APM HTTP requests (such as for webtop, logon pages, SAML URIs, etc). Make sure you don't have any other irules with HTTP_REQUEST events that might interfere with user logons.

when CLIENT_ACCEPTED {
  ACCESS::restrict_irule_events disable
}

when HTTP_REQUEST {
  if { [HTTP::cookie exists "MRHSession" ] && [ACCESS::session exists -state_allow] } {
  # user seems to have a valid session, let them get the backend resource
  return
} else {
  if { [HTTP::uri] contains "favicon" } {
    # remove the following log line after testing
    log local0. "user has no session, sending 404 for favicon request"
    HTTP::close
    HTTP::respond 404
    }
  }
}