Ajax endpoint publish externally?

Plugins Sécurité
1

How does endpoint / URL Status updates work? I’ve allowed direct via cloudflare, (and tested without cloudflare) for /core /plugins and I still don’t get status updates from Ajax…

I created a sync_ajax.php endpoint - that triggers an outbound sync to the ajax endpoint. However it’s easy to hit the 2000 calls per 24 hour, as each sync seems to hit the api per equipment device. (so this approach is not good)

Cloudflare

Allowed paths regex:

^/(core/.|plugins/ajaxSystem/.|sync_ajax.php)$

This restricts public access to only:

  • /core/*
  • /plugins/ajaxSystem/*
  • /sync_ajax.php

Everything else can remain protected or blocked.

Traefik

Two routers.

API router (no OIDC)

Host(jeedom.example.com) &&
(
PathPrefix(/core/) ||
PathPrefix(/plugins/ajaxSystem/) ||
Path(/sync_ajax.php)
)

  • No auth middleware
  • Higher priority than UI router
  • Routes to Jeedom backend

Example labels:

traefik.http.routers.jeedom_api.rule=(Host(jeedom.example.com)) && (PathPrefix(/core/) || PathPrefix(/plugins/ajaxSystem/) || Path(/sync_ajax.php))
traefik.http.routers.jeedom_api.priority=100
traefik.http.routers.jeedom_api.service=jeedom

UI router (OIDC protected)

Host(jeedom.example.com)

  • Lower priority
  • OIDC middleware applied
  • Catches everything else

Information Jeedom

Core : 4.5.3 (4.5.3)
DNS Jeedom : No

Plugin : Ajax Systems
Version : 2026-02-27 01:22:05 (stable)

sync_ajax.php (my sins)

<?php
require_once __DIR__ . '/core/php/core.inc.php';

try {
    if (!class_exists('ajaxSystem')) {
        throw new Exception('Ajax plugin not loaded');
    }

    $plugin = plugin::byId('ajaxSystem');
    if (!is_object($plugin)) {
        throw new Exception('Ajax plugin not found');
    }

    ajaxSystem::sync();

    echo "OK";
} catch (Exception $e) {
    echo "ERROR: " . $e->getMessage();
}```