Make the ajax calls POST methods, and make the 'Create Entry' in the tree configurable so calls to children() can just return child entries

app/Http/Controllers/AjaxController.php

@@ -38,7 +38,7 @@ class AjaxController extends Controller
 	 */
 	public function children(Request $request): Collection
 	{
-		$dn = Crypt::decryptString($request->query('_key'));
+		$dn = Crypt::decryptString($request->post('_key'));
 
 		// Sometimes our key has a command, so we'll ignore it
 		if (str_starts_with($dn,'*') && ($x=strpos($dn,'|')))
@@ -57,13 +57,18 @@ class AjaxController extends Controller
 					'tooltip'=>$item->getDn(),
 				])
 			->prepend(
-				[
+				$request->create
+					? [
 						'title'=>sprintf('[%s]',__('Create Entry')),
 						'item'=>Crypt::encryptString(sprintf('*%s|%s','create',$dn)),
 						'lazy'=>FALSE,
 						'icon'=>'fas fa-fw fa-square-plus text-warning',
 						'tooltip'=>__('Create new LDAP item here'),
-				]);
+					]
+					: []
+			)
+			->filter()
+			->values();
 	}
 
 	public function schema_view(Request $request)

public/js/custom.js

@@ -59,7 +59,7 @@ $(document).ready(function() {
 	if (typeof basedn !== 'undefined') {
 		sources = basedn;
 	} else {
-		sources = { url: '/ajax/bases' };
+		sources = { method: 'POST', url: '/ajax/bases' };
 	}
 
 	// Attach the fancytree widget to an existing <div id="tree"> element
@@ -95,8 +95,9 @@ $(document).ready(function() {
 		source: sources,
 		lazyLoad: function(event,data) {
 			data.result = {
+				method: 'POST',
 				url: '/ajax/children',
-				data: {_key: data.node.data.item,depth: 1}
+				data: {_key: data.node.data.item,create: true}
 			};
 
 			expandChildren(data.tree.rootNode);

routes/web.php

@@ -63,8 +63,8 @@ Route::controller(HomeController::class)->group(function() {
 Route::controller(AjaxController::class)
 	->prefix('ajax')
 	->group(function() {
-		Route::get('bases','bases');
-		Route::get('children','children');
+		Route::post('bases','bases');
+		Route::post('children','children');
 		Route::post('schema/view','schema_view');
 		Route::post('schema/objectclass/attrs/{id}','schema_objectclass_attrs');
 	});