Best way to deny access to URL

Assuming all the links in those applications are prefaced with those uris:

when HTTP_REQUEST {
  if { !(([string tolower [HTTP::uri]] starts_with '/nyc') || ([string tolower [HTTP::uri]] starts_with '/albany')) } {
    HTTP::respond 403
  }
}

Hi xbox360, I had a similar issue where I wanted to apply an action based on the URL. I did this via the ASM policy, when filtering by referrer I needed to mark as 'do nothing' and then the URL specified from the referrer specified passed through. In your case you want to block connections with a similar rule. My case is noted here, I hope something there may help: https://devcentral.f5.com/questions/allowed-url-however-its-still-being-blocked?