ASM issue, need to return HTTP 500 to client in certain cases

First of all, both your cases 1 and 2 can be checked in HTTP_REQUEST, where you could use an HTTP::respond 200 or an HTTP::respond 500 however you wished. But let's presume that you meant something about Content-Type: application/json is triggering the ASM and you'd like to generate that 500 response as per the ASM being triggered.

As you've found, you cannot initiate an HTTP::respond from within whichever ASM event you're using (e.g., ASM_REQUEST_BLOCKING). Instead, while you're in the ASM event set a variable and then hook the HTTP_RESPONSE_RELEASE event to modify the response that's going out to the client.

For example:

when HTTP_REQUEST {
    set asm_disliked_content_type 0
}

when ASM_REQUEST_BLOCKING {
    set asm_info [ASM::violation_data]
    if {[string first {VIOLATION_CONTENT_TYPE} [lindex $asm_info 0]] != -1} {
        set asm_disliked_content_type 1
    }
}

when HTTP_RESPONSE_RELEASE {
    if {$asm_disliked_content_type == 1} {
        HTTP::respond 500 content "Buzz Off"
        event disable all
        return
    }
}

Note that I made up VIOLATION_CONTENT_TYPE so this code won't work without adjustment... But the point is to show how you can use variables to maintain state from one event to another.

You might be able to do this by allowing 500 in policy under "Allowed Response status codes" and then capturing the response code with "when HTTP_RESPONSE" and evaluate whether to allow or block at that point, in an iRule.

Mel, I believe "Allowed Response Status Codes" only applies to the responses generated by the protected application. Response codes generated on the F5 are permitted regardless of whether they're on the Allowed list or not. The purpose of "Allowed Response Status Codes" is to prevent a broken application from leaking too much information about itself when attacked.

Also, as OP noted, HTTP_RESPONSE doesn't trigger if the ASM steps in and blocks the request before it's sent to the pool. HTTP_RESPONSE_RELEASE does, though.

Thank you very kindly for taking the time to assist me. Your advice helped lead me to the solution.