iRule to prevent XSS attack

Use ASM module which is meant for it. Going with iRule is fixing broken bones with band aids.

For mitigating XSS attacks executed via HTTP headers or HTTP URI, a LTM iRule solution would not be that bad. However, for complete mitigation, you also need to look for XSS attacks in POST payload. For that last scenario, a iRule solution is not feasible. It would cause significant degradation of your app performance.