Secure Programmatic Advertising Demo (Flask + HTTPS)

A secure programmatic advertising demo using Flask and HTTPS. This project focuses on implementing robust web security practices, including HTTPS (SSL/TLS), Signed Cookies, and persistent Session Tracking.

Features

• Local HTTPS: Uses mkcert for a trusted local development environment.
• Secure Sessions: Implements Flask session for tamper-proof visitor counting.
• User Profiles: Persistent storage of user interests and visit analytics.
• Targeted Ads: Basic ad targeting logic based on user data and loyalty.
• Database Persistence: SQLite-backed user management with hashed passwords and profile tracking.

---

Security Features Explained

• Secure=True: Ensures cookies are only sent over encrypted HTTPS connections.
• HttpOnly=True: Prevents client-side scripts (JavaScript) from accessing session cookies, mitigating XSS attacks.
• SameSite=Lax: Protects against Cross-Site Request Forgery (CSRF) while allowing essential functionality.
• Session Signing: Uses a SECRET_KEY to sign data, preventing users from manually editing their visit counts in the browser console.

---

Setup Instructions

1. Clone the Repository

git clone https://github.com/toxicbishop/Cookies-in-Python.git
cd Cookies-in-Python

---

2. Create a Python Virtual Environment

Linux / macOS (bash)

python3 -m venv .venv
source .venv/bin/activate

Windows Command Prompt (cmd)

python -m venv .venv
.venv\Scripts\activate.bat

Windows Bash

python -m venv .venv
source .venv/Scripts/activate

Windows PowerShell

python -m venv .venv
.venv\Scripts\Activate.ps1

---

3. Install Project Dependencies

Upgrade pip (recommended):

python -m pip install --upgrade pip

Install the required packages:

pip install -r requirements.txt

---

4. Install mkcert

You'll need mkcert to create trusted local SSL certificates.

Windows

choco install mkcert

macOS

brew install mkcert

Ubuntu / Debian

sudo apt install mkcert libnss3-tools

Install the local Certificate Authority:

mkcert -install

---

5. Generate Local HTTPS Certificates

Run:

mkcert localhost 127.0.0.1 ::1

This generates:

• localhost+2.pem
• localhost+2-key.pem

These certificates are used by Flask to serve HTTPS locally.

---

6. Database Setup

The application uses SQLite.

To manually initialize the database:

sqlite3 users.db < schema.sql

Note: If users.db does not exist, the application automatically creates the required database and tables on first launch.

---

7. Run the Application

Start the Flask application:

python cookies.py

Open your browser and visit:

https://127.0.0.1:5001

Accept the local certificate if prompted (this should only happen if mkcert is not installed correctly).

---

Project Structure

.
├── cookies.py                 # Main Flask application
├── requirements.txt           # Python dependencies
├── schema.sql                 # SQLite schema
├── users.db                   # SQLite database (generated locally)
├── static/
│   └── profile_pics/          # Uploaded profile images
├── .gitignore
├── LICENSE
└── README.md

---

Security Features

• HTTPS using locally trusted SSL certificates.
• Secure, signed Flask session cookies.
• HttpOnly session cookies.
• Secure cookie flag.
• SameSite=Lax cookie protection.
• Password hashing using Werkzeug.
• SQLite-backed persistent user storage.
• Protected profile image uploads using secure_filename().

---

License

This project is licensed under the MIT License. See the LICENSE file for details.