Dropping connections after a specific part of URI

Hi AbuAhmad,

If the uri starts with /xyz/web/apx then you can use the following irule:

when HTTP_REQUEST {
  if { [HTTP::uri] starts_with "/xyz/web/apx/" } {
     drop
  }
}

Otherwise your irule is almost correct. Just remove the asteriks at the end of the uri.

Have a nice day.

Thank you Oguzy for the quick response,

I tried this before but it drops the connection that I need to keep:

https://host.name.com/xyz/web/apx/ << need this to still function including the "/" at the end but anything after that "/" should be dropped.

Thats why I tried the "/*" as wildcard at the end as I don't have list of all the directories that comes after that but need to block all of them.

Any ideas will be highly appreciated.

Thank you Oguzy so much for your help, this one worked as requested. I added to it "HTTP::respond 403" instead of "drop" to give a meaningful message.

The client came back saying they can't block everyone passed apx/ :(

So I am going to use data groups to block certain directories until they provide the full list.

Thanks again for the help Oguzy.