f5 Access Policy Manager AJAX vs Non-Ajax Request Handling with Authentication

See if this helps:

when ACCESS_SESSION_STARTED { 
  if { [HTTP::header "X-Requested-With" ] equals "XMLHttpRequest" } {     
     ACCESS::respond 401 
  }   
}

See if this helps:

when ACCESS_SESSION_STARTED { 
  if { [HTTP::header "X-Requested-With" ] equals "XMLHttpRequest" } {     
     ACCESS::respond 401 
  }   
}

Will this iRule only hit when the session has expired or is invalid?

No, this will hit as long as the header matches. Assumption is the first time you hit APM you don't have this header. Again, I'm not sure how you want to handle the 401 response.

Create the irule - Local Traffic ›› iRules : iRule List ›› Create

Add to VS- Local Traffic ›› Virtual Servers : Virtual Server List ›› ›› iRule Manage

Will this iRule only hit when the session has expired or is invalid?

No, this will hit as long as the header matches. Assumption is the first time you hit APM you don't have this header. Again, I'm not sure how you want to handle the 401 response.

Create the irule - Local Traffic ›› iRules : iRule List ›› Create

Add to VS- Local Traffic ›› Virtual Servers : Virtual Server List ›› ›› iRule Manage

I just found this in the docs: https://devcentral.f5.com/wiki/iRules.ACCESS__session.ashx

when HTTP_REQUEST {
   set apm_cookie [HTTP::cookie value MRHSession]
   if { $apm_cookie != "" && ! [ACCESS::session exists $apm_cookie] } {
      HTTP::respond 401 WWW-Authenticate "Basic realm=\"www.example.com\""  
      return
   }
}

It looks like it's specifically checking every HTTP Request and if the session is not active it will respond with a 401 Unauthorized Response. I think this is what I'm looking for.

..the user's session has expired, to respond with a 401 http response when the request has the header X-Requested-With: XMLHttpRequest.

when ACCESS_SESSION_STARTED { 
  if { [HTTP::header "X-Requested-With" ] equals "XMLHttpRequest" && [HTTP::header "Referer" ] contains "my.logout.php3" } {     
     ACCESS::respond 401 
  }   
}

..the user's session has expired, to respond with a 401 http response when the request has the header X-Requested-With: XMLHttpRequest.

when ACCESS_SESSION_STARTED { 
  if { [HTTP::header "X-Requested-With" ] equals "XMLHttpRequest" && [HTTP::header "Referer" ] contains "my.logout.php3" } {     
     ACCESS::respond 401 
  }   
}

I'm wondering how in the first place the application manages to passes the policy without 302 support.

when HTTP_REQUEST {
    HTTP::header insert "clientless-mode" 1
}