How to Detect and Block a Web Application?

is your goal solely to tell if users are accessing via a mobile browser vs. via your app? Because if so, your most straightforward option may be to adjust the mobile app code to insert a cookie into the session, and use an iRule or LTM policy to check for that cookie in the session. How important is it that your results be 100% correct? If so, that cookie approach can be "hardened" to be very difficult to spoof by maintaining e.g. a table of valid cookies (and making the cookie value hard to predict/replicate). The ASM approaches mentioned can be quite sophisticated, but from my understanding aren't 100%. That may be fine for your situation .