diff --git a/Gemfile b/Gemfile
index 1c7700e..3b34e4a 100644
--- a/Gemfile
+++ b/Gemfile
@@ -51,6 +51,9 @@ gem "bootsnap", require: false
 # Use Active Storage variants [https://guides.rubyonrails.org/active_storage_overview.html#transforming-images]
 # gem "image_processing", "~> 1.2"
 
+# Use Rack CORS for handling Cross-Origin Resource Sharing (CORS), making cross-origin AJAX possible
+gem "rack-cors"
+
 group :development, :test do
   # See https://guides.rubyonrails.org/debugging_rails_applications.html#debugging-with-the-debug-gem
   gem "debug", platforms: %i[ mri mingw x64_mingw ]
diff --git a/Gemfile.lock b/Gemfile.lock
index 8dee3eb..9865dc2 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -137,6 +137,8 @@ GEM
       nio4r (~> 2.0)
     racc (1.6.0)
     rack (2.2.4)
+    rack-cors (1.1.1)
+      rack (>= 2.0.0)
     rack-test (2.0.2)
       rack (>= 1.3)
     rails (7.0.3)
@@ -212,6 +214,7 @@ DEPENDENCIES
   jbuilder
   pg (~> 1.1)
   puma (~> 5.0)
+  rack-cors
   rails (~> 7.0.2, >= 7.0.2.4)
   sprockets-rails
   stimulus-rails
diff --git a/app/controllers/properties_controller.rb b/app/controllers/properties_controller.rb
new file mode 100644
index 0000000..8912da2
--- /dev/null
+++ b/app/controllers/properties_controller.rb
@@ -0,0 +1,64 @@
+class PropertiesController <ApplicationController
+    skip_before_action :require_login, only: :index
+    before_action :set_property, only: %i[ show update destroy]
+
+    def owned
+        render json: current_user.properties, status: :ok
+    end
+
+    def index
+        if current_user
+            render json: Property.where.not(user: current_user), status: :ok
+        else
+            render json: Property.all, status: :ok
+        end
+    end
+    
+    def show
+        render json: @property, status: :ok
+    end
+
+    def create
+        property = Property.new(property_params)
+        property.user = current_user
+        if property.save
+            render json: property, status: :created
+        else
+            render json: property.errors, status: :unprocessable_entity
+        end
+    end
+
+    def update
+        if @property.update(property_params)
+            render json: @property
+        else
+            render json: @property.errors, status: :unprocessable_entity
+        end
+    end
+
+    def destroy
+        @property.destroy
+    end
+
+    private 
+
+    def set_property
+        @property = Property.find(params[:id])
+    end
+
+    def property_params
+        params.permit(
+            :operationType, 
+            :address, 
+            :rentType, 
+            :rentAmount, 
+            :maintenance, 
+            :propertyType, 
+            :bedrooms, 
+            :bathrooms, 
+            :area, 
+            :petsAllowed, 
+            :about
+        )
+    end        
+end
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index d9d3736..5fa31a1 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -11,6 +11,11 @@ def create
     end
 
     def destroy
-        current_user.invalidate_token
+        if current_user && current_user.invalidate_token
+            render json: {}, status: :no_content
+        else
+            render json: nil, status: :internal_server_error
+        end
     end
+
 end
\ No newline at end of file
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 2ed127a..304e6ed 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -14,7 +14,7 @@ def create
 
     #------------------
     def show
-        render json: current_user
+        render json: current_user, status: :ok
     end
 
     #------------------
@@ -36,4 +36,4 @@ def create_user_params
     def update_user_params
         params.permit(:name, :password)
     end
-end
\ No newline at end of file
+end
diff --git a/app/models/property.rb b/app/models/property.rb
index 0bee24f..a65e827 100644
--- a/app/models/property.rb
+++ b/app/models/property.rb
@@ -16,6 +16,6 @@ class Property < ApplicationRecord
     validates :bedrooms, presence: true
     validates :bathrooms, presence: true
     validates :area, presence: true
-    validates :petsAllowed, inclusion: { in: [true, false]}
+    validates :petsAllowed, inclusion: { in: [true, false], message: "should be true or false"}
     validates :about, presence: true, length: { in: 20..500 }, allow_blank: false
 end
\ No newline at end of file
diff --git a/app/models/user.rb b/app/models/user.rb
index 15afdee..1d9b7e9 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -4,7 +4,9 @@ class User < ApplicationRecord
 
     has_many :properties, dependent: :destroy
     has_many :likes, dependent: :destroy
+    has_many :liked_properties, through: :likes, source: :property
     has_many :contacts, dependent: :destroy
+    has_many :contacted_properties, through: :contacts, source: :property
 
     VALID_EMAIL_REGEX = /\A[\w+\-.]+@[a-z\d\-.]+\.[a-z]+\z/i
     validates :name, presence: :true, allow_blank: false
diff --git a/config/initializers/cors.rb b/config/initializers/cors.rb
new file mode 100644
index 0000000..0306451
--- /dev/null
+++ b/config/initializers/cors.rb
@@ -0,0 +1,15 @@
+# Be sure to restart your server when you modify this file.
+# Avoid CORS issues when API is called from the frontend app.
+# Handle Cross-Origin Resource Sharing (CORS) in order to accept cross-origin AJAX requests.
+# Read more: https://github.com/cyu/rack-cors
+
+Rails.application.config.middleware.insert_before 0, Rack::Cors do
+    allow do
+      origins "*"
+  
+      resource "*",
+               headers: :any,
+               methods: %i[get post put patch delete options head]
+    end
+  end
+  
\ No newline at end of file
diff --git a/config/routes.rb b/config/routes.rb
index 4419032..5d74f90 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -1,8 +1,16 @@
 Rails.application.routes.draw do
+  # User
   get "/profile", to: "users#show"
   patch "/profile", to: "users#update"
+  post "/signup", to: "users#create"
 
+  # Sessions
   post "/login", to: "sessions#create"
-  post "/signup", to: "users#create"
   delete "/logout", to: "sessions#destroy"
+
+  # Properties"
+  resource :properties do
+    get "/index", to: "properties#index"
+    get "/owned", to: "properties#owned"
+  end
 end
diff --git a/db/seeds.rb b/db/seeds.rb
index f3fec1a..92866a3 100644
--- a/db/seeds.rb
+++ b/db/seeds.rb
@@ -8,7 +8,7 @@
     many: { users: 100, properties: 300 },
 }
 
-current_config = :few
+current_config = :many
 
 User.destroy_all
 Property.destroy_all
@@ -43,6 +43,7 @@
         bedrooms: rand(1..10), 
         bathrooms: rand(1..5), 
         area: rand(1..10000), 
+        petsAllowed: Faker::Boolean.boolean(true_ratio: 0.2), 
         about: Faker::Hipster.paragraph_by_chars(characters: 300) )
     if property.valid?
         property.save