diff --git a/js/entity_reference_tree.js b/js/entity_reference_tree.js
index afc91c00b520eed18b78c240ae1f06f23e6fbe4a..273ce0a4fb87ff8222fa8cb89265215100a3e879 100644
--- a/js/entity_reference_tree.js
+++ b/js/entity_reference_tree.js
@@ -17,11 +17,10 @@
           const dots = treeContainer.attr("dots");
           // Avoid ajax callback from running following codes again.
           if (widgetElement.length) {
-            const entityType = $("#entity-reference-tree-entity-type").val();
             const bundle = $("#entity-reference-tree-entity-bundle").val();
-            const token = settings["entity_tree_token_" + fieldEditName];
             const idIsString = bundle === "*";
             const limit = parseInt(settings["tree_limit_" + fieldEditName]);
+            const dataURL = settings["data_url_" + fieldEditName];
             let selectedNodes;
             // Selected nodes.
             if (idIsString) {
@@ -66,12 +65,7 @@
                 data: {
                   url: function(node) {
                     return Drupal.url(
-                      "admin/entity_reference_tree/json/" +
-                        entityType +
-                        "/" +
-                        bundle +
-                        "?token=" +
-                        token
+                      dataURL
                     );
                   },
                   data: function(node) {
diff --git a/src/Form/SearchForm.php b/src/Form/SearchForm.php
index ac869256517510f532572b018db932e2d521b1fb..b4225b9d63aab1e45ef60b1531392c9c586be1ff 100644
--- a/src/Form/SearchForm.php
+++ b/src/Form/SearchForm.php
@@ -2,6 +2,7 @@
 
 namespace Drupal\entity_reference_tree\Form;
 
+use Drupal\Core\Url;
 use Drupal\Core\Form\FormBase;
 use Drupal\Core\Form\FormStateInterface;
 use Drupal\Core\Ajax\AjaxResponse;
@@ -37,7 +38,7 @@ class SearchForm extends FormBase {
   /**
    * {@inheritdoc}
    */
-  public function buildForm(array $form, FormStateInterface $form_state, $field_edit_id = '', $bundles = '', $entity_type = '', $theme = 'default', $dots = false) {
+  public function buildForm(array $form, FormStateInterface $form_state, $field_edit_id = '', $bundles = '', $entity_type = '', $theme = 'default', $dots = FALSE) {
     // Do nothing after the form is submitted.
     if (!empty($form_state->getValues())) {
       return [];
@@ -53,19 +54,19 @@ class SearchForm extends FormBase {
 
     // Selected entity text.
     $form['selected_text'] = [
-        '#type' => 'html_tag',
-        '#tag' => 'div',
-        '#value' => $this
+      '#type' => 'html_tag',
+      '#tag' => 'div',
+      '#value' => $this
         ->t('Selected Entities'),
-        '#weight' => 1000,
-        '#attributes' => [
-            'class' => [
-                'selected-entities-text',
-            ],
-            'id' => [
-                'entity-reference-tree-selected-text',
-            ],
+      '#weight' => 1000,
+      '#attributes' => [
+        'class' => [
+          'selected-entities-text',
         ],
+        'id' => [
+          'entity-reference-tree-selected-text',
+        ],
+      ],
     ];
     // Hidden field for submitting selected entity IDs.
     $form['selected_node'] = [
@@ -97,7 +98,7 @@ class SearchForm extends FormBase {
           'entity-reference-tree-wrapper',
         ],
         'theme' => $theme,
-        'dots' => $dots, 
+        'dots' => $dots,
       ],
     ];
     // Submit button.
@@ -160,11 +161,14 @@ class SearchForm extends FormBase {
         ],
       ],
     ];
-    
+
     // Pass data to js file.
     $form['#attached']['drupalSettings'] = [
-        'entity_tree_token_' . $field_edit_id => \Drupal::csrfToken()->get($bundles),
-        'tree_limit_' . $field_edit_id => empty($limit) ? -1 : $limit, 
+      'data_url_' . $field_edit_id => mb_substr(Url::fromRoute('entity_reference_tree.json', [
+        'entity_type' => $entity_type,
+        'bundles' => $bundles,
+      ])->toString(), 1) . '?token=' . \Drupal::csrfToken()->get($bundles),
+      'tree_limit_' . $field_edit_id => empty($limit) ? -1 : $limit,
     ];
 
     return $form;
@@ -181,7 +185,10 @@ class SearchForm extends FormBase {
       $response->addCommand(new ReplaceCommand('#entity_reference_tree_wrapper', $form));
     }
     else {
-      $response->addCommand(new InvokeCommand(NULL, 'entitySearchDialogAjaxCallback', [$form_state->getValue('field_id'), $form_state->getValue('selected_node')]));
+      $response->addCommand(new InvokeCommand(NULL, 'entitySearchDialogAjaxCallback', [
+        $form_state->getValue('field_id'),
+        $form_state->getValue('selected_node'),
+      ]));
       $response->addCommand(new CloseEntityReferenceTreeModalDialogCommand());
     }
 
diff --git a/src/Tree/EntityTreeBuilder.php b/src/Tree/EntityTreeBuilder.php
index 8cb4581e10fcbff3edbea7c86dce96514c44598d..337f939d35639bee4243e3ac1b300561bbd6cedf 100644
--- a/src/Tree/EntityTreeBuilder.php
+++ b/src/Tree/EntityTreeBuilder.php
@@ -70,21 +70,23 @@ class EntityTreeBuilder implements TreeBuilderInterface {
         // Load all entities matched the conditions.
         $entities = $entityStorage->loadByProperties($properties);
       }
-      
+
       // Build the tree.
       foreach ($entities as $entity) {
-        $tree[] = (object) [
-          'id' => $entity->id(),
-        // Required.
-          'parent' => $hasBundle ? $entity->bundle() : '#',
-        // Node text.
-          'text' => $entity->label(),
-        ];
+        if ($entity->access('view')) {
+          $tree[] = (object) [
+            'id' => $entity->id(),
+            // Required.
+            'parent' => $hasBundle ? $entity->bundle() : '#',
+            // Node text.
+            'text' => $entity->label(),
+          ];
+        }
       }
 
       return $tree;
     }
-    // The user is not allowed to access taxonomy overviews.
+    // The user does not have the permission.
     return NULL;
   }