I am using fullcalendar to fetch a json feed (https://fullcalendar.io/docs/events-json-feed).

var calendar = new Calendar(calendarEl, {
  events: '/myfeed.php'

Here, I am fetching events from a google calendar.

$api_key = 'xxx';
$calendar_id = 'xxx';

$url = "https://www.googleapis.com/calendar/v3/calendars/$calendar_id/events?key=$api_key";
$response = file_get_contents($url);
$events = json_decode($response, true);

$formatted_events = array();
foreach ($events['items'] as $event) {
$formatted_events[] = array(
'title' => $event['summary'],
'start' => $event['start']['dateTime'] ?? $event['start']['date'],
'end' => $event['end']['dateTime'] ?? $event['end']['date']
echo json_encode($formatted_events);

When typing the address of <myserver>/myfeed.php in the address bar, one can also directly access the json elements.


As this feed is in a private part of the website, it is easy to prevent anyone to access the feed (e.g. using isset($_SESSION['user'] in myfeed.php).

But how can I prevent a user with a valid session to directly type the address of my.feed.php and then access the feed ?

I thought I could place myfeed.php above the $_SERVER['DOCUMENT_ROOT'] but I guess it is not 'safe' to allow a js code (see above) to access a file above the $_SERVER['DOCUMENT_ROOT'].




$postedUrl = $_SERVER['REQUEST_URI'];
if ( $postedUrl !='/admin/myfeed') {
// fetch events 

in myfeed.php seems working. But is this secure enough ?

  • 1
    You're trying to stop users from accessing content you want the users to access. Give up. It doesn't work. The user can trivially bypass any restrictions you place, and it's trivial to see in the developer console.
    – vidarlo
    Nov 25, 2023 at 15:41
  • Yes ... you are right ....
    – 2WFR
    Nov 25, 2023 at 16:08
  • At least what I do prevent the user to access the complete calendar (e.g. between 2022 and 2023) as the display (and so the response) show events for a week maximum.
    – 2WFR
    Nov 25, 2023 at 16:12
  • Change the backend to only send a week into the future.
    – vidarlo
    Nov 25, 2023 at 17:27

1 Answer 1


The short answer is that you shouldn't try.

Yes, there are things you can do, but they will be complex and fragile. One obvious solution is to set a time-limited, single use token in the server-side session when a user access a page which should be permit access to the calendar.

it is not 'safe' to allow a js code (see above) to access a file above the $_SERVER['DOCUMENT_ROOT']

I have no idea what you are saying here. It is impossible to access content directly outside the document root (which includes mappings to paths elsewhere).

But is this secure enough ?

  1. I have no idea how this enforces your constraint

  2. We don't know how much security you actually want in this scenario

  • Thanks. Apologies if I was not clear. With the above solution (see Edit), a user see a blank page when typing the address of myfeed but FullCalendar still can access the feed.
    – 2WFR
    Nov 25, 2023 at 13:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .