exclude some paths from signature based ASM

You could try creating a unique ID for the cookie, persist on it and then insert the cookie in responses. But you're basically just manually recreating what the default cookie insert persistence profile does. So why not just use that?

 

 

I think you could probably use that instead of the JSESSIONID persistence iRule. The JSESSIONID persistence iRule is only really useful if you need to persist at multiple tiers (client to web and web to app) or if clients don't support cookies and need to use the JSESSIONID in the URIs.

 

 

Aaron