Drupal is a registered trademark of Dries Buytaert
drupal 11.3.7 Update released for Drupal core (11.3.7)! drupal 11.2.11 Update released for Drupal core (11.2.11)! drupal 10.6.7 Update released for Drupal core (10.6.7)! drupal 10.5.9 Update released for Drupal core (10.5.9)! cms 2.1.1 Update released for Drupal core (2.1.1)! drupal 11.3.6 Update released for Drupal core (11.3.6)! drupal 10.6.6 Update released for Drupal core (10.6.6)! cms 2.1.0 Update released for Drupal core (2.1.0)! bootstrap 8.x-3.40 Minor update available for theme bootstrap (8.x-3.40). menu_link_attributes 8.x-1.7 Minor update available for module menu_link_attributes (8.x-1.7). eca 3.1.1 Minor update available for module eca (3.1.1). layout_paragraphs 2.1.3 Minor update available for module layout_paragraphs (2.1.3). ai 1.3.3 Minor update available for module ai (1.3.3). ai 1.2.14 Minor update available for module ai (1.2.14). node_revision_delete 2.0.3 Minor update available for module node_revision_delete (2.0.3). moderated_content_bulk_publish 2.0.52 Minor update available for module moderated_content_bulk_publish (2.0.52). klaro 3.0.10 Minor update available for module klaro (3.0.10). klaro 3.0.9 Minor update available for module klaro (3.0.9). layout_paragraphs 2.1.2 Minor update available for module layout_paragraphs (2.1.2). geofield_map 11.1.8 Minor update available for module geofield_map (11.1.8).

ajax_requirement

46 sites Security covered
View on drupal.org

This is an API module. You probably do not need this, unless a module you need requires it, or you are writing a module that requires it.

Very small module that you can use to make sure your route is only accessible via AJAX requests.

The module does nothing in itself, it only provides the access check service needed to define your routes like this:

my_module.my_ajax_path:
  path: '/my-ajax-path'
  defaults:
    _title: 'Ajax path'
    _controller: '\Drupal\my_module\Controller\AjaxController::build'
  requirements:
    _permission: 'my permission'
    _is_ajax_request: 'TRUE'

You can also do the opposite:

my_module.my_non_ajax_path:
  path: '/my-non-ajax-path'
  defaults:
    _title: 'Non ajax path'
    _controller: '\Drupal\my_module\Controller\AjaxController::build'
  requirements:
    _permission: 'my permission'
    _is_ajax_request: 'FALSE'

The actual check uses the Symfony method isXmlHttpRequest which is included here for clarity:

public function isXmlHttpRequest()
{
    return 'XMLHttpRequest' == $this->headers->get('X-Requested-With');
}

Activity

Total releases
1
First release
Mar 2025
Latest release
1 year ago
Release cadence
Stability
100% stable

Releases

Version Type Release date
2.0.3 Stable Mar 25, 2025