In admin I have the following controller:

namespace Vendor\Module\Controller\Adminhtml;

use Magento\Backend\App\Action\Context;

class Test extends \Magento\Backend\App\Action
     * @var \Magento\Framework\View\Result\PageFactory
    protected $resultPageFactory;

     * @param \Magento\Backend\App\Action\Context $context
    public function __construct(
            Context $context,
            \Magento\Framework\Controller\Result\JsonFactory $resultJsonFactory
    ) {
        $this->resultJsonFactory = $resultJsonFactory;

    public function execute()
         return $this->resultJsonFactory->create()->setData([
            'this' => 'test'

in Vendor/Module/etc/adminhtml/routes.xml I have:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:App/etc/routes.xsd">
    <router id="admin">
        <route id="module" frontName="module">
            <module name="Vendor_Module" />

In javascript I do the following ajax request to that controller:

jQuery.ajax( {
        url: location.protocol + '//' + location.host+'/admin/module/test',
        data: {form_key: window.FORM_KEY},
        type: 'POST'
    }).done(function(a) { 

And I receive 404 error

http://mydomain/admin/module/test?isAjax=true 404 (Forbidden)

as well.. same thing...

Why is this happening ?

4 Answers 4


you should make the call to location.protocol + '//' + location.host+'/admin/vendor/module/test'

or try location.protocol + '//' + location.host+'/admin/module/test'

  • nope... didnt work, same thing - 404 forbidden Feb 23, 2016 at 15:08
  • 1
    how does your etc/adminhtml/routes.xml file look like?
    – Marius
    Feb 23, 2016 at 15:10
  • <?xml version="1.0"?> <config xmlns:xsi="w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:App/etc/routes.xsd"> <router id="admin"> <route id="module" frontName="module"> <module name="Vendor_Module" /> </route> </router> </config> Feb 23, 2016 at 15:12
  • see my edit. If that does not work, I'm out of ideas.
    – Marius
    Feb 23, 2016 at 15:15
  • sadly, it didn't ... :( 10x anyway the weirdest error though ... 404 Forbidden... I've never seen this before Feb 23, 2016 at 15:19

I had the same issue. The reason could be, that the formkey is invalid, because it is not added to the url.

My advice:

  • Do not use location.protocol or something else like location.host
  • Instead let the url be generated by PHP and then pass it to javascript in phtml file or as a variable (for example in a function created by block).

Creation in PHP (from block) is:

$this->getUrl('frontname/myController', $params )


  • frontname is defined in your route-file etc/adminhtml/routes.xml,
  • $params are the post-parameters (can be an empty array).

Also it can be a cache-problems:

  • Check if you have caches disabled
  • run the command: php bin/magento cache:clean
  • run the command: rm -r var/generation
  • Clearing the cache did the trick for me Dec 5, 2017 at 17:22

Ок, this does not make any sense to me.

In Vendor/Module/Controller/Adminhtml/ I have the fallowing controllers:


If I send anjax to :

location.protocol + '//' + location.host+'/admin/module/module/index


location.protocol + '//' + location.host+'/admin/module/test/test

they both succeed. If I send ajax to ajax to

location.protocol + '//' + location.host+'/admin/module/double

i get

http://mydomain/admin/module/double?isAjax=true 404 (Forbidden)

Wtf is this :) And what is error 404 Forbidden :) ?


I don't know how it is possible, but i had the same error and i fixed it adding

 * Array of actions which can be processed without secret key validation
 * @var string[]
protected $_publicActions = ['test'];

and it starts to work, but now it continues to work even if $_publicActions is removed or commented out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.