How can you block/reject subdirectories only, with an irule?

@Yann's use of the

switch

is an absolutely sensible approach. I would like to highlight two minor things, however. Firstly, unless your underlying filesystem or the encoded URI-path elements are really case-insensitive, I would advise omitting the

string tolower

. RFC 3986 says (of URIs in general):

When a URI uses components of the generic syntax, the component
syntax equivalence rules always apply; namely, that the scheme and
host are case-insensitive and therefore should be normalized to
lowercase.  For example, the URI  is
equivalent to .  The other generic syntax
components are assumed to be case-sensitive unless specifically
defined otherwise by the scheme (see Section 6.2.3).

So, unless the filesystem is case-insensitive or the HTTP server provides virtual paths that it handles in a case-insensitive fashion, the

string tolower

is extra processing without advantage. Ordinarily, with software, this is fine (and can even be considered good defensive coding) but with iRules, it's generally best to optimize for performance.

I mention this here only because I very often see this pattern. For matching against, say,

HTTP::host

, it is needed (as the RFC reference above notes), but for

HTTP::path

, it often is not.

Secondly, the

default

branch in this case is unnecessary (unless you really need to do something in the default case). The extra overhead is very probably negligible (and may even be optimized away). I point it out only to make clear that an explicit default branch is not required for a

switch

.