A11y scan hardening: block non-AJAX mobile nav callback access

[accesswatch]

Summary

• Prevents non-AJAX crawling of the mobile navigation callback endpoint.
• This endpoint is intended to return Drupal AJAX commands, not standalone HTML documents.

Issue types targeted from CSV

• html-has-lang
• document-title
• label

These were reported on /az_core/mobile_nav_callback/... URLs where scanners treated AJAX payloads as full pages.

Change

1. modules/custom/az_core/src/Controller/MobileNavController.php
   • Injects request_stack and checks isXmlHttpRequest().
   • Returns 404 for non-AJAX requests.
   • Preserves current AJAX behavior for legitimate mobile menu requests.

Impact

• Impacted files: 1
• Scope: high-confidence endpoint hardening for crawler-facing false-positive reduction.

[Copilot]

Pull request overview

Hardens the az_core.mobile_nav_callback controller endpoint so it only serves Drupal AJAX command payloads to legitimate AJAX requests, reducing accessibility scanner false-positives caused by crawlers treating the callback response as a standalone page.

Changes:

• Inject request_stack into MobileNavController.
• Reject non-AJAX requests by throwing NotFoundHttpException (404) before building the AJAX response.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.