Creating a custom app signature to block by URL path

[svintinner]

I'm hoping to get some help with a custom signature that I've created.  We're trying to block users from playing flash games on facebook, but still allow them to get to everything else.  For example:  https://apps.facebook.com/candycrush.  The URL category is social-networking and the application is facebook-apps.

I've created a signature to detect the app as follows:

 facebook-candycrush {
     subcategory gaming;
     category media;
     technology browser-based;
     risk 2;
     data-ident no;
     parent-app facebook-apps;
     default {
         port tcp/443;
     }
     signature {
         facebook-candycrush-url {
             and-condition {
                 "And Condition 1" {
                     or-condition {
                         "Or Condition 1" {
                             operator {
                                 pattern-match {
                                     pattern apps\.facebook\.com;
                                     context http-req-host-header;
                                 }
                             }
                         }
                     }
                 }
                 "And Condition 2" {
                     or-condition {
                         "Or Condition 1" {
                             operator {
                                 pattern-match {
                                     pattern candycrush;
                                     context http-req-uri-path;
                                 }
                             }
                         }
                     }
                 }
             }
             scope protocol-data-unit;
             order-free no;
             comment "Detect apps.facebook.com/candycrush";
         }
     }
    

Picture of the GUI config:

I'm missing something with the AND syntax.  It works fine if I only look for the http-req-host-header or if I only look for the http-req-uri-path, but when I add both, it doesn't work.

Any help would be appreciated.

[svintinner · Accepted solution]

Solved my problem by changing from transaction to session and removing ordered condition match.

[Raido_Rattameister · Accepted solution]

Why don't you use custom url category and block this category with security profile?

[svintinner]

Well that would certainly be easier.  I guess I was under the impression that URL Categories only worked on hostnames or domains, not paths.

[Raido_Rattameister]

You can use path. For example permit single Youtube video.

[svintinner]

I just tested and of course it works perfectly.  Thanks so much for setting me straight.