Block a specific URL that only ends with a specific keyword

Try that:

In the URL : https://example.com/Logon/login?service=

• HTTP::host is example.com
• HTTP::path is /Logon/login
• HTTP::query is service=
• HTTP::uri is /Logon/login?service=

.

when HTTP_REQUEST {
switch -glob [string tolower [HTTP::path]] {
    "*/logon" -
    "*/logon/login" {
        if {[HTTP::query] equals ""} {
            HTTP::respond 404 content {
                
                    
                        Access denied
                    
                    
                    Access denied
                    
                
                } noserver
            return
        }
    }
}