Ravi Sir's Cyber Security Cards › Revision Cards
The Feed API and Likes
The Feed API and Likes feed.php returns the list of posts as JSON. like.php adds or removes a like. The feed returns only what the page needs. Never password hashes or private S3 keys. Not logged in? It returns 401 , not data. like.php accepts only POST with a CSRF token. A two-column primary key (u
Read card text
What this card says
What it is
feed.php returns the list of posts as JSON. like.php adds or removes a like.
Why it matters for security
The feed returns only what the page needs. Never password hashes or private S3 keys.
Not logged in? It returns 401, not data.
Likes
like.php accepts only POST with a CSRF token.
A two-column primary key (user, post) allows one like per user per post.
Learn more in the lesson: 16.8 The Feed API and Likes