How can I allowlist source IP just call to only URI path was declare?

[datnt10]

What is the name of the domain?

ncb-bank.vn

What is the issue you’re encountering

just allow source ip allowlist call to uri path

What are the steps to reproduce the issue?

I just need source IP and uri path matching will skip waf rule and call to backend. But when I config follow below picture, source ip can call to all path after hostname.
P/s: with only 1 uri path rule is working, but when I need matching 02 URI path, rule is not working.

Screenshot of the error

[sdayman]

You will need to use the Expression Editor to manually regroup the OR at the end.

It will look like:
ip.src in $tests and http.host eq "hostname" and (starts_with(http.request.uri.path, "/one") or starts_with(http.request.uri.path, "/two"))

[datnt10]

I was create successed with Expression Editor, but this way is not good. and I will difficult control my rule when need extend rule.