SECRET_KEY and security settings in Django - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the SECRET_KEY in a Django project?

The SECRET_KEY is a secret value used by Django to provide cryptographic signing. It helps protect data like session cookies and password reset tokens from being tampered with.

beginner

Why should the SECRET_KEY never be shared or exposed publicly?

If the SECRET_KEY is exposed, attackers can forge session cookies or tokens, leading to security breaches like user impersonation or data leaks.

intermediate

Name two important security settings in Django besides SECRET_KEY.

1. DEBUG: Should be set to False in production to avoid showing sensitive error details.<br>2. ALLOWED_HOSTS: Lists the host/domain names your Django site can serve to prevent HTTP Host header attacks.

beginner

What is the risk of setting DEBUG = True in a production environment?

With DEBUG = True, detailed error pages with sensitive information are shown to users, which can help attackers find vulnerabilities.

intermediate

How can you keep your SECRET_KEY safe when sharing your Django project code?

You can store the SECRET_KEY outside your code, for example in environment variables or separate config files not included in version control, so it is not shared publicly.

What is the main use of Django's SECRET_KEY?

A To sign cookies and tokens securely

B To connect to the database

C To set the website title

D To configure static files

The SECRET_KEY is used to cryptographically sign cookies and tokens to prevent tampering.

Which setting should be False in production to avoid exposing sensitive info?

A ALLOWED_HOSTS

B DEBUG

C INSTALLED_APPS

D STATIC_URL

DEBUG should be False in production to prevent detailed error pages from showing.

What does the ALLOWED_HOSTS setting do?

A Stores the secret key

B Enables debug mode

C Lists allowed domain names for the site

D Defines database connections

ALLOWED_HOSTS restricts which host/domain names the Django app can serve.

What is a good practice to keep your SECRET_KEY safe?

A Use a simple string like 'password'

B Hardcode it in your public code

C Share it on GitHub

D Store it in environment variables

Storing the SECRET_KEY in environment variables keeps it out of public code and safer.

What could happen if your SECRET_KEY is leaked?

A Attackers can forge session cookies

B Your database will be deleted

C Your website will load slower

D Your static files won't load

Leaking the SECRET_KEY allows attackers to create fake session cookies and impersonate users.

Explain why the SECRET_KEY is critical for Django security and how to protect it.

Think about what happens if someone can fake your cookies or tokens.

Describe the role of DEBUG and ALLOWED_HOSTS settings in securing a Django app.

Consider what happens if error details are shown or if any host can access your app.