diff --git a/app/controllers/draft_controller.rb b/app/controllers/draft_controller.rb
index 8fb9c0a6eb2..d3cc2b731da 100644
--- a/app/controllers/draft_controller.rb
+++ b/app/controllers/draft_controller.rb
@@ -6,6 +6,8 @@ class DraftController < ApplicationController
   skip_before_action :check_xhr, :preload_json
 
   def show
+    raise Discourse::NotFound.new if params[:draft_key].blank?
+
     seq = params[:sequence] || DraftSequence.current(current_user, params[:draft_key])
     render json: { draft: Draft.get(current_user, params[:draft_key], seq), draft_sequence: seq }
   end
diff --git a/spec/requests/draft_controller_spec.rb b/spec/requests/draft_controller_spec.rb
index 7663a5118d6..c84f3fceb32 100644
--- a/spec/requests/draft_controller_spec.rb
+++ b/spec/requests/draft_controller_spec.rb
@@ -27,6 +27,19 @@ describe DraftController do
     expect(response.status).to eq(404)
   end
 
+  it "returns a draft if requested" do
+    user = sign_in(Fabricate(:user))
+    Draft.set(user, 'hello', 0, 'test')
+
+    get "/draft.json", params: { draft_key: 'hello' }
+    expect(response.status).to eq(200)
+    json = ::JSON.parse(response.body)
+    expect(json['draft']).to eq('test')
+
+    get "/draft.json"
+    expect(response.status).to eq(404)
+  end
+
   it 'checks for an conflict on update' do
     user = sign_in(Fabricate(:user))
     post = Fabricate(:post, user: user)