Portfolio Demonstration & Engineering Showcase
Riyora
Modern Authentication, Security & Commerce Platform
A portfolio-grade web application demonstrating secure authentication, payment integration, modern UI/UX design, privacy-first architecture, and production deployment practices.
Google
OAuth 2.0 Access
Active
Security Shield
PayPal
PayPal Checkout
Docker
Production-Ready
Demonstrated Capabilities
Key areas of engineering excellence integrated inside this platform
🔑 Authentication
Strict Google OAuth 2.0 federated login interface. Fully removes insecure local forms and password storage, adhering to zero-trust passwordless authentication.
🛡️ Security
Layered defenses including Double-Submit WTF-CSRF protection, rate limiting on sensitive forms, automatic 15-minute inactivity timers, and Secure/HttpOnly session cookies.
💳 Payments
PayPal checkout integration combined with static UPI QR payments, demonstrating secure external payment flows.
🚢 Deployment
Dockerized container stack utilizing Gunicorn WSGI servers and a custom REST health check endpoint (/health) to verify environmental diagnostics.
💎 UI/UX Design
Modern glassmorphic Stripe/Linear design style featuring full prefers-reduced-motion support, keyboard outline accessibility, and a seamless Dark/Light theme toggler.
📁 Database Management
Relational SQLite schema featuring automated column migrations, telemetry logging counters, and data privacy cleanup jobs executing on request triggers.
Project Case Study
🔍 Why This Project Was Built
Designed to serve as a comprehensive staff-level engineering artifact. It bridges the gap between typical tutorial apps and complex enterprise SaaS systems by emphasizing defensive security, clean modular routes, and a premium visual aesthetic.
🛠️ Technologies & Packages
Built with Flask as the microframework, SQLite for database isolation, and security extensions (WTForms for CSRF protection, Limiter for rate limits). Local QR rendering is driven by qrcode and pillow.
🛡️ Security Challenges Solved
Mitigates vulnerabilities including SQL Injection (parameterized queries), CSRF (WTF-CSRF middleware), session hijacking (HttpOnly & SameSite cookies), and brute-force vectors (rate-limiting endpoints).
🚢 Deployment Readiness
Fully containerized with a Dockerfile and docker-compose.yml configuration using Gunicorn for production execution. Includes a secure `/health` checks router suited for cloud environments like Render and Railway.
🎓 Educational Purpose
Serves as a safe demonstration platform for verifying real-world payment SDK workflows, secure session logic, and OAuth callback handling in Python, providing recruiter-ready technical transparency.
⚙️ Automated Administration
Equipped with a secure role-based access control (RBAC) mechanism. Restricts administrator privileges dynamically to the designated owner email read from environment parameters.
Technology Stack Showcase
Python
Flask
SQLite
Google OAuth
PayPal
Docker
Gunicorn
HTML5
CSS3
JavaScript
Interactive Architecture Showcase
User
Browser Client➔
Frontend
HTML5, CSS3, JS➔
Flask Backend
Modular routes➔
Auth Layer
Google OAuth 2.0Database
SQLite3 Isolation➔
Payment Provider
PayPal IntegrationSecurity Dashboard
Google OAuth
✓ Active
🔑
Admin Protection
✓ Active
🛡️
CSRF Protection
✓ Active
🛡️
Rate Limiting
✓ Active
⏱️
Secure Sessions
✓ Active
🍪
Privacy Controls
✓ Active
🔒
| Security Protections | Purpose & Mechanics | Recruiter/Hiring Value | Status |
|---|---|---|---|
| Google OAuth Verification | Restricts authentication to Google Identity Provider flow, eliminating credentials handling. | Demonstrates compliance with modern passwordless federated standards. | ✓ Active |
| CSRF Protection | WTF-CSRF token verification across checkout, cart requests, and telemetry logs. | Prevents unauthorized state changes via cross-site requests. | ✓ Active |
| Rate Limiting | Protects checkout and login endpoints against brute force using memory-backed Flask-Limiter. | Blocks automated stuffing and denial-of-service attempts. | ✓ Active |
| Session Expiration | Inactivity logout cleans session data after 15 minutes of idle status. | Restricts window for session theft on shared client systems. | ✓ Active |
| Environment Variables | Loads payment client tokens, keys, and DB paths via python-dotenv, excluding real keys from source. | Zero hardcoded secrets. Avoids token leaks. | ✓ Active |
| Secure Cookies | Sets HttpOnly=True and SameSite=Lax headers on session tokens. | Prevents XSS cookie access and mitigates CSRF scope. | ✓ Active |
| Input Validation | Strict form parameter checks, escaping database queries dynamically. | Defends against SQL injection and cross-site scripting (XSS). | ✓ Active |
| Privacy Data Retention | Removes guest logs and orders older than 24 hours automatically from database. | Shows engineering respect for storage lifecycle and user privacy. | ✓ Active |
🛡️ Privacy Dashboard
As a demo platform, user privacy is prioritized. Review our database cleaning policy below:
Demo Orders Expired Automatically
Guest Session Cookies Expired
Registered Google Users Kept Intact
Demo Products Catalog
Support the Project
If you found this project useful, you can support future development.
Support via UPI
If you'd like to support this project, you can do so using UPI.
sharmavashudev99@okaxis
Scan the QR code or copy the UPI ID.
Support via PayPal
If you'd like to support this project, you can do so using PayPal.
Scan the QR code or use the PayPal button.
Let's Connect
Have feedback, project ideas or questions about Riyora? I'd be happy to hear from you.
Dev Sharma
B.Tech CSE Student Full Stack & AI Enthusiast