diff --git a/app/controllers/static_controller.rb b/app/controllers/static_controller.rb
index 8061545f7..422387699 100644
--- a/app/controllers/static_controller.rb
+++ b/app/controllers/static_controller.rb
@@ -2,6 +2,7 @@
 
 class StaticController < ApplicationController
   respond_to :html, :json, :xml
+  skip_forgery_protection only: :not_found, if: -> { request.format.js? }
 
   def privacy_policy
   end
diff --git a/app/views/static/not_found.js b/app/views/static/not_found.js
new file mode 100644
index 000000000..e69de29bb
diff --git a/test/functional/static_controller_test.rb b/test/functional/static_controller_test.rb
index 77f1332a4..a84fc056b 100644
--- a/test/functional/static_controller_test.rb
+++ b/test/functional/static_controller_test.rb
@@ -71,6 +71,13 @@ class StaticControllerTest < ActionDispatch::IntegrationTest
       assert_equal("Page not found", response.parsed_body.xpath("result/message").text)
     end
 
+    should "return a JS response for a 404'd .js request" do
+      get "/qwoiqogieqg.js"
+
+      assert_response 404
+      assert_equal("", response.body)
+    end
+
     should "render the 404 page when page_not_found_pool_id is configured" do
       as(create(:user)) do
         @post = create(:post, tag_string: "artist:bkub")