Welcome to those parents among you.

Today, for those tuning in online, is freshmen family weekend.

We have quite a few guests with us and we

thought we would begin today in fact by perhaps putting everyone

at ease since I know this is perhaps the first time in a while

that you've been back to college.

Maybe this is your first class for the fall semester.

And so we thought we'd share with you by proxy

what you might be feeling by way of a short film

that CS50's video team put together with a little friend of ours

just a few semesters ago.

[VIDEO PLAYBACK]

[MUSIC PLAYING]

- Hi.

- Hello

[END PLAYBACK]

DAVID MALAN: All right, well, welcome to Harvard and CS50.

So if you'd like to actually return in just a few weeks time,

your children or siblings or friends or here in the room

will be exhibiting their CS50 final projects in just a few weeks' time.

This is the so-called CS50 fair, which is

meant to be a campus wide exhibition of students' final projects.

And it's worth noting that, as the students in the class know,

68% of the students in CS50 this year had no prior CS experience.

And so what you and they will see on display at the CS fair

in a few weeks' time in December is all of their accomplishments.

And in fact, the goal of this event really

is to delight in what everyone has achieved and glancing

at each other's screens and phones to see with great surprise what

each of our students has pulled off.

So you are invited back if you would like for that as well.

Now CS50 of course is characterized as a class

for those less comfortable and those more comfortable

and those somewhere in between.

And I daresay some of our guests today are perhaps

at one end of that spectrum or the other.

And so rest assured that what we'll dive into today,

the world of databases and SQL with applications to data science

and beyond, is new to most everyone in the room as well.

So you are in good company, and I daresay 68% or more

of percent of the parents in the room are perhaps feeling exactly as you are.

So if we can now turn our attention back to some things lower level,

those students among you will recall that we focused in recent days

on Python, this other higher level language by which you

can solve problems a bit more readily than you can using, say, something

lower level like C. Now you might have noticed I'm ready if you dived

into problem set 6 as I'm sure you have, the debug 50 only

supports C and not Python.

So you have relatively fewer tools at your disposal for debugging.

But do realize that within the CS50 library for Python

is a function like this called eprint, which

you might recall if you've used eprintf with C.

This is a Python version of the same.

And so if you need help debugging your programs,

it suffices to write a program in Python.

And anywhere you want to see diagnostic output,

simply call this eprint function.

And it will print the file name and the line number for which you

have written that line of code.

But let's turn our attention now to things more web-oriented

and perhaps something with which you're familiar Facebook

and the login screen thereof.

So there's so many websites out there today where when you visit them,

you're prompted to log in-- something like this.

But you're not prompted to log in every time you click a link on facebook.com.

You're not prompted to log in every minute or every two minutes

because indeed, the websites, if they required as much,

they would degrade into something downright unusable.

So instead, these websites remember that you're logged in somehow.

So you log in once per day, per week, per year.

It varies by website.

And then somehow the website remembers that you are Maria or you are Brian

and you have already logged into this website.

Now how might that work?

How does Facebook or any site like it, Gmail and beyond,

remember that you are logged in once you are logged in even though you only

type your username and password once?

AUDIENCE: [INAUDIBLE]

DAVID MALAN: OK, so they store information on the server.

And indeed, that's exactly right.

On the server, as we're now starting to see with Python and today with SQL,

you have the ability to store information on a server.

We saw very simply about a week ago the ability to store data

in, like, CSV files, just text files on the server.

That's not going to be very high performing,

so we're going to do better than that today.

But you can also store data in variables inside a flask

while it's running as we saw as well.

But we'll need some more sophistication than that.

But yes, we can certainly remember that Maria or Brian have logged in.

But how do we remember from which computer or browser

Maria or Brian have logged in?

AUDIENCE: [INAUDIBLE]

DAVID MALAN: Via the IP address-- so could work.

You could just recall that from those virtual envelopes

which I no longer have today.

We've been writing the to address in the from address, the IP address, on those

envelopes.

So you could certainly remember, oh, I saw Brian from 1.2.3.4 and Maria

from 4.5.6.7 or whenever the numbers actually are.

But that's a problem in, like, households and frankly even

on campuses these days because of NAT, Network Address Translation,

that technique whereby a bunch of us probably in this room right now

on our laptops or phones are sharing the same IP address, at least so

far as the outside world is concerned.

So we could confuse things.

And that would be bad because that means if Brian sort of logs into Facebook

and Maria logs into Facebook, suddenly Brian

might actually see Maria's profile page or the like.

So what else might they be doing?

What's that?

AUDIENCE: Cookie?

DAVID MALAN: Cookie, so-- eh, correct answer, but what in the world

does that mean?

AUDIENCE: [INAUDIBLE]

DAVID MALAN: Don't know--

OK.

So, perfect-- so you're in the right place.

And most everyone in this room probably, if you use the web frequently,

have generally heard about cookies and probably that they're dangerous or bad

or some way or you've probably googled how

to clear your cookies if you've indeed heard they're

a bad thing or something like that.

And indeed, cookies are the answer to this question.

But how does that actually work?

Well, if you've been to like an amusement park or a club

or someplace where you typically have a ticketed access gate, sometimes if you

want to come in go to and from the parking lot or out to the street

or wherever, they might stamp your hand using like a little red stamp

or invisible stamp or the like.

And then you just show it to the bouncer or the person at the checker

that you had been there before because you have this hand

stamp via the remembering you.

So web servers and browsers are kind of the same.

When you visit Facebook or Gmail or wherever for the first time

and moreover log in, they essentially put like a digital hand

stamp on your browser called a cookie.

And that handstand happens to be implemented

not obviously as ink but like as a big random number that

is given just to you.

And it's stored either in your computer's RAM

or on your computer's hard drive longer term.

And your browser, because it speaks HTTP,

that protocol we've been talking about, it

has been designed to show its hand, so to speak.

Every time you revisit Facebook, every time you click an email,

every time you send a message, anytime you browse around on that same website,

the browser is, without you realizing it, reminding

the server of that hand stamp.

So how might it be doing it?

Where can a browser sort of tuck away information like this such

that it's always in that envelope?

Yeah.

AUDIENCE: It can put it like into a list like you did before with the invites

or something like that.

DAVID MALAN: The invites, the invites--

oh, so that would be lower lev-- so, OK, I remember now.

So that would be not quite there because we

want to make sure that this has nothing to do fundamentally

with our application.

This has to do with HTTP.

So this was invented years ago before there was like a list of registrants

for [INAUDIBLE].

So we can't put it there.

Yeah.

AUDIENCE: [INAUDIBLE]

DAVID MALAN: A concept of a cache-- not here, no, no.

Yeah.

AUDIENCE: [INAUDIBLE] header.

DAVID MALAN: The header-- so the header is

where we have access to metadata, sort of lower level technical information

that most of us never see unless you poke around Chrome

or actually sniff your own internet traffic and see.

But we do have the ability, within these HTB headers, to send, so to speak,

this virtual hand stamp.

So let's recall what these headers look like.

So the headers that get sent in this virtual envelope

when you request Facebook's home page, for instance,

might look like this-- get slash, which means get me the home page,

using version 1.1.

The host I'm visiting, just as a reminder,

is facebook.com or www.facebook.com.

And then below that is maybe more headers.

We've generally waived our hands at it because they're not as interesting

but there might be some more information there too.

Well, when Facebook replies, especially after you've

logged in, it turns out one of the headers we haven't looked

at in addition to these which we have seen, the response,

the 200 OK from the server, is that Facebook and servers

like it are probably sending this header as well, literally

Set-Cookie colon and then a name and then a value or key and a value.

The name here, for instance, I'm going to start calling session,

as is the term of art.

And then the value to the right can actually be anything.

So value might be 123, 456, or any unique value

that's sort of randomly generated by the server to remember who you are.

And so session equals value is like this is your hand and this is your value.

That is now the cookie that's been planted on the computer.

And what your browser thereafter is supposed to do is not send set cookie.

That only comes from server to browser.

But whenever you on Facebook request another page,

click a friend's profile page or the like,

your virtual envelope will contain not these familiar headers

but also cookie session equals value.

And so that is the presentation of that same key value pair.

So if Facebook now to your point earlier remembers

that user 123456 has logged in and that user happens to be named Maria

and we can store that information on the server,

every time Facebook sees this same hand stamp

or sees this same session equals value, it'll be like, oh, that must be Maria.

And so I'll show Maria her messages and her profile page

and all that comes with it in a website.

So let's take a step back because the mechanism is as relatively

simple as this, even though it's certainly arcane

and you have to kind of know what you're doing to leverage this.

But is there a threat here?

Like, why might cookies be dangerous and why do people

tell us occasionally to delete them?

AUDIENCE: If some one gains access to [INAUDIBLE]..

DAVID MALAN: Yeah, if someone gains access to your cookies,

you could masquerade as someone else like Maria.

And so in the sort of equivalent at a club or a part

would be if you kind of do this with someone else's hand and try to say,