irule, restict path no work!!!

You need to allow access to the required resources in the application, and you will need to maintain the list of allowed paths as the application changes - there is no easy way to avoid this.

First - use a Local Traffic Policy instead of an irule - they are faster, more efficient and more maintainable.

K15085:  Overview of the Local Traffic Policies feature (11.4.0 - 12.0.0)

Second - you can use a datagroup to maintain the list of valid paths in the application. This makes maintenance easier as well.

Finally, consider ASM - it can learn and manage valid URIs fro the application.