SECRET_KEY and security settings in Django - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to set a secret key in Django settings.

Django

SECRET_KEY = '[1]'

Drag options to blanks, or click blank then click option'

AINSTALLED_APPS

BDEBUG = True

CALLOWED_HOSTS = []

Dyour-secret-key-here

Attempts:

3 left

💡 Hint

Common Mistakes

Using settings like DEBUG or ALLOWED_HOSTS instead of a secret key string.

Leaving SECRET_KEY empty or as a placeholder.

The SECRET_KEY is a string used by Django for cryptographic signing. It must be set to a unique, unpredictable value.

2fill in blank

medium

Complete the code to disable debug mode in production.

Django

DEBUG = [1]

Drag options to blanks, or click blank then click option'

AFalse

B0

CTrue

DNone

Attempts:

3 left

💡 Hint

Common Mistakes

Setting DEBUG to True in production.

Using string 'False' instead of boolean False.

In production, DEBUG must be set to False to avoid exposing sensitive information.

3fill in blank

hard

Fix the error in the allowed hosts setting to allow only example.com.

Django

ALLOWED_HOSTS = [[1]]

Drag options to blanks, or click blank then click option'

A'localhost'

B'example.com'

C'*'

Dexample.com

Attempts:

3 left

💡 Hint

Common Mistakes

Using unquoted domain names causing syntax errors.

Using '*' which allows all hosts (not secure).

The ALLOWED_HOSTS list must contain strings representing allowed domain names. Use quotes around the domain.

4fill in blank

hard

Fill both blanks to set secure cookie settings in Django.

Django

SESSION_COOKIE_SECURE = [1]
CSRF_COOKIE_SECURE = [2]

Drag options to blanks, or click blank then click option'

ATrue

BFalse

CNone

D'True'

Attempts:

3 left

💡 Hint

Common Mistakes

Using string 'True' instead of boolean True.

Setting these to False in production.

Setting both SESSION_COOKIE_SECURE and CSRF_COOKIE_SECURE to True ensures cookies are sent only over HTTPS.

5fill in blank

hard

Fill all three blanks to configure Django security settings for HTTPS and headers.

Django

SECURE_SSL_REDIRECT = [1]
SECURE_HSTS_SECONDS = [2]
SECURE_CONTENT_TYPE_NOSNIFF = [3]

Drag options to blanks, or click blank then click option'

ATrue

BFalse

C31536000

D0

Attempts:

3 left

💡 Hint

Common Mistakes

Setting SECURE_SSL_REDIRECT to False in production.

Using 0 for SECURE_HSTS_SECONDS disables HSTS.

Setting SECURE_CONTENT_TYPE_NOSNIFF to False.

Setting SECURE_SSL_REDIRECT to True redirects HTTP to HTTPS. SECURE_HSTS_SECONDS sets the HSTS header duration (1 year = 31536000 seconds). SECURE_CONTENT_TYPE_NOSNIFF set to True prevents content type sniffing.