A11y scan hardening: block non-AJAX mobile nav callback access

[accesswatch]

Summary

• Prevents non-AJAX crawling of the mobile navigation callback endpoint.
• This endpoint is intended to return Drupal AJAX commands, not standalone HTML documents.

Issue types targeted from CSV

• html-has-lang
• document-title
• label

These were reported on /az_core/mobile_nav_callback/... URLs where scanners treated AJAX payloads as full pages.

Change

1. modules/custom/az_core/src/Controller/MobileNavController.php
   • Injects request_stack and checks isXmlHttpRequest().
   • Returns 404 for non-AJAX requests.
   • Preserves current AJAX behavior for legitimate mobile menu requests.

Impact

• Impacted files: 1
• Scope: high-confidence endpoint hardening for crawler-facing false-positive reduction.

[Copilot]

Pull request overview

Hardens the az_core.mobile_nav_callback controller endpoint so it only serves Drupal AJAX command payloads to legitimate AJAX requests, reducing accessibility scanner false-positives caused by crawlers treating the callback response as a standalone page.

Changes:

• Inject request_stack into MobileNavController.
• Reject non-AJAX requests by throwing NotFoundHttpException (404) before building the AJAX response.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[az-digital-bot]

Tugboat has finished building the preview for this pull request!

Link:

• https://pr5642-n4xghjxwthnpt0xaj2ad8ovkksksbpgg.tugboatqa.com

Dashboard:

• https://dashboard.tugboatqa.com/6a76349d3457b1eeda2a2d54

[bberndt-uaz]

The proposed solution does not appear to work. Try clicking on this and observe that you don't get a 404: https://pr5642-n4xghjxwthnpt0xaj2ad8ovkksksbpgg.tugboatqa.com/az_core/mobile_nav_callback/main/Main%20Menu.

The isXmlHttpRequest() method merely checks for a X-Requested-With header which may or may not be present with AJAX requests. Also, I don't see this method being used this way in Drupal core. Moreover, as far as I can tell, there is no reliable way to determine if a request was made with AJAX. We could explore some kind of alternate solution in the future, but I think this pull request can be closed.