[plibither8]

This might not be addressing your issue directly, but for my browser extension Refined Hacker News [1], once a user is logged-in in the browser site it is fairly simple to "construct" the favorite-ing endpoint URL. The URL endpoint is "/fave" and requires two query parameters: `auth` and `id`. "auth" is a random string that is unique for each story/comment and is generated from the HN server (it's required for authorization of the "favorite" request), and "id" is the story/comment's ID number.

The auth string of a story for "fave" is the same as the auth string for the "hide" and "flag" links (since they are already present, the links' hrefs contain that auth string), and so we can extract the auth string from their hrefs and use it for favoriting and un-favoriting.

Moreover, I've created a simple API which can be used to get all the favorited items of a user: https://github.com/plibither8/hn-faves-api

1: https://github.com/plibither8/refined-hacker-news