BIG-IP LTM/ASM Order of Operations

This question came up recently in regards to HTTP to HTTPS redirect iRule. We know they can be abused for example using the host field inject which redirects the user to another site, so our ASM engineer and I were curious to know which comes first in this case. On the surface I'd say that the packet would never make it to ASM. I will do some testing.

/jeff