Skip to main content
Drupal is a registered trademark of Dries Buytaert
Release: OpenID Connect / OAuth client 3.0.0-alpha9 New alpha version released for module openid_connect (3.0.0-alpha9). Usage Milestone: Google Analytics Module google_analytics crossed 1,000 active installs. Release: Timelinr 1.0.1 Minor update available for module timelinr (1.0.1). Release: GraphQL Compose Codegen 1.1.2 Minor update available for module graphql_compose_codegen (1.1.2). Release: Mapy.com 1.1.3 Minor update available for module mapycom (1.1.3). Release: Ckeditor5 entity browser 3.0.3 Minor update available for module ckeditor5_entity_browser (3.0.3). Release: Ckeditor5 entity browser 3.0.1 Minor update available for module ckeditor5_entity_browser (3.0.1). Release: Ckeditor5 entity browser 3.0.2 Minor update available for module ckeditor5_entity_browser (3.0.2). Release: Teamleader Integration 4.0.2 Minor update available for module teamleader (4.0.2). Module Revived: Entityqueue Buttons 1.1.2 Module entityqueue_buttons updated after 8 months of inactivity (1.1.2).

Ajax requirement

105 sites Security covered Drupal 8–11
View on drupal.org

This module provides a simple way to ensure that certain routes are only accessible through AJAX requests, or conversely, can prevent access from AJAX requests. It acts as an API for other modules that need to enforce these specific access conditions.

This is an API module. You probably do not need this, unless a module you need requires it, or you are writing a module that requires it.

Very small module that you can use to make sure your route is only accessible via AJAX requests.

The module does nothing in itself, it only provides the access check service needed to define your routes like this:

my_module.my_ajax_path:
  path: '/my-ajax-path'
  defaults:
    _title: 'Ajax path'
    _controller: '\Drupal\my_module\Controller\AjaxController::build'
  requirements:
    _permission: 'my permission'
    _is_ajax_request: 'TRUE'

You can also do the opposite:

my_module.my_non_ajax_path:
  path: '/my-non-ajax-path'
  defaults:
    _title: 'Non ajax path'
    _controller: '\Drupal\my_module\Controller\AjaxController::build'
  requirements:
    _permission: 'my permission'
    _is_ajax_request: 'FALSE'

The actual check uses the Symfony method isXmlHttpRequest which is included here for clarity:

public function isXmlHttpRequest()
{
    return 'XMLHttpRequest' == $this->headers->get('X-Requested-With');
}

Depends on

Dependencies of the latest stable release

No dependencies recorded for this project.

Required by

Tracked projects that depend on this one

No tracked projects depend on this one yet.

Activity

Tracked releases
1
Tracked since
Mar 2025
Latest release
1 year ago
Releases (12 mo)
0 ▼ from 1
Maintenance
Dormant

Releases

Version Type Core Release date
2.0.3 Stable 8–11 Mar 25, 2025