Session expiry behavior in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when SESSION_COOKIE_AGE is set to 0?

In Django settings, if you set SESSION_COOKIE_AGE = 0, what will be the behavior of the session cookie in the browser?

A The session cookie will expire immediately and the user will be logged out on the next request.

B Django will raise a configuration error and refuse to start.

C The session cookie will never expire and remain valid indefinitely.

D The session cookie will behave like a browser-length cookie and expire when the browser is closed.

💡 Hint

Think about what a zero value means for cookie expiration in browsers.

Setting SESSION_COOKIE_AGE = 0 makes the session cookie a browser-length cookie. This means it will expire when the user closes the browser, not immediately or never.

❓ state_output

intermediate

What is the session expiry time after calling set_expiry(300)?

Given a Django view where request.session.set_expiry(300) is called, what is the session expiry behavior?

Django

def my_view(request):
    request.session.set_expiry(300)
    return HttpResponse('Hello')

A The session will expire after 300 seconds (5 minutes) from the last activity.

B The session will expire after 300 seconds from when the session was created, ignoring activity.

C The session will never expire because set_expiry disables expiration.

D The session will expire immediately because 300 is treated as False.

💡 Hint

Check Django docs on set_expiry with integer values.

Calling set_expiry(300) sets the session to expire 300 seconds after the last request that modified the session.

📝 Syntax

advanced

Which code snippet correctly sets a session to expire at browser close?

Select the Django code snippet that correctly sets the session to expire when the browser closes.

A request.session.set_expiry(-1)

B request.session.set_expiry('browser')

C request.session.set_expiry(None)

D request.session.set_expiry(0)

💡 Hint

Remember the special meaning of 0 in set_expiry.

Using set_expiry(None) sets the session to expire when the browser closes. Other values have different meanings or cause errors.

🔧 Debug

advanced

Why does session never expire despite set_expiry(10)?

A developer sets request.session.set_expiry(10) in a Django view, but the session never expires after 10 seconds. What is the most likely cause?

A The session cookie is set with a max-age of 0, overriding set_expiry.

B The SESSION_SAVE_EVERY_REQUEST setting is True, so expiry resets on every request.

C The server time is incorrect, causing expiry to fail.

D set_expiry only works with values greater than 60 seconds.

💡 Hint

Think about how SESSION_SAVE_EVERY_REQUEST affects session expiry.

If SESSION_SAVE_EVERY_REQUEST = True, the expiry time resets on every request, so the session never expires as long as the user keeps interacting.

🧠 Conceptual

expert

What error occurs if you call set_expiry with a string other than 'session' or 'never'?

In Django, what happens if you call request.session.set_expiry('invalid_string')?

A Raises a ValueError indicating invalid expiry value.

B Silently ignores the invalid value and keeps previous expiry.

C Raises a TypeError because string is not allowed.

D Sets the session to never expire regardless of the string.

💡 Hint

Check Django source or docs on allowed string values for set_expiry.

Django's set_expiry accepts only integers, None, or strings 'session' or 'never'. Any other string raises a ValueError.

Practice

1. What does the set_expiry() method do in Django sessions?

easy

A. It encrypts the session data.

B. It deletes the session immediately.

C. It sets how long a user's session will last before expiring.

D. It creates a new session key for the user.

Solution

1. Step 1: Understand the purpose of set_expiry()

   This method controls the lifetime of a session by setting its expiration time.

2. Step 2: Compare options with the method's function

   Only It sets how long a user's session will last before expiring. correctly describes that set_expiry() sets how long the session lasts before it expires.

3. Final Answer:

   It sets how long a user's session will last before expiring. -> Option C

4. Quick Check:

   Session expiry time = set_expiry() [OK]

Hint: Remember: set_expiry controls session lifetime [OK]

Common Mistakes:

• Confusing set_expiry() with session deletion
• Thinking it creates or encrypts sessions
• Assuming it resets session data

2. Which of the following is the correct way to set a session to expire in 300 seconds in Django?

easy

A. request.session.expire(300)

B. request.session.set_expiry(300)

C. request.set_expiry(300)

D. session.set_expiry_time(300)

Solution

1. Step 1: Identify the correct method and object

   The method set_expiry() is called on request.session to set expiry time.

2. Step 2: Check syntax correctness

   request.session.set_expiry(300) uses the correct method and object: request.session.set_expiry(300). Other options use incorrect method names or objects.

3. Final Answer:

   request.session.set_expiry(300) -> Option B

4. Quick Check:

   Correct method call = request.session.set_expiry(300) [OK]

Hint: Call set_expiry on request.session, not request [OK]

Common Mistakes:

• Calling set_expiry on request instead of request.session
• Using wrong method names like expire or set_expiry_time
• Missing parentheses or wrong argument

3. Given this code snippet, what will be the session expiry behavior?

request.session.set_expiry(0)

medium

A. The session expiry will use the default global timeout.

B. The session will never expire.

C. The session will expire after 0 seconds immediately.

D. The session will expire when the browser is closed.

Solution

1. Step 1: Understand what passing 0 to set_expiry means

   In Django, setting expiry to 0 means the session expires when the browser closes (a browser-length session).

2. Step 2: Compare with other options

   The session will expire when the browser is closed. matches this behavior. The session will never expire. is false because 0 does not mean never expire. The session will expire after 0 seconds immediately. is incorrect because it does not expire immediately. The session expiry will use the default global timeout. is incorrect because default timeout is overridden.

3. Final Answer:

   The session will expire when the browser is closed. -> Option D

4. Quick Check:

   set_expiry(0) = expire on browser close [OK]

Hint: 0 means expire on browser close, not immediately [OK]

Common Mistakes:

• Thinking 0 means no expiry
• Assuming immediate expiry at 0 seconds
• Confusing with default session timeout

4. What is wrong with this code snippet if the goal is to set the session to expire after 10 minutes?

request.session.set_expiry = 600

medium

A. It assigns a value to the method instead of calling it.

B. The expiry time should be in milliseconds, not seconds.

C. The session object does not have set_expiry attribute.

D. The value 600 is too large and causes an error.

Solution

1. Step 1: Analyze the code syntax

   The code assigns 600 to set_expiry instead of calling it as a method with parentheses.

2. Step 2: Understand correct usage

   The correct usage is request.session.set_expiry(600) to call the method and set expiry time.

3. Final Answer:

   It assigns a value to the method instead of calling it. -> Option A

4. Quick Check:

   Use parentheses to call set_expiry() [OK]

Hint: Use parentheses to call set_expiry(), not assignment [OK]

Common Mistakes:

• Assigning value instead of calling method
• Confusing seconds with milliseconds
• Believing 600 causes error due to size

5. You want a session to expire after 5 minutes but also want to keep the session alive if the user is active. Which approach correctly achieves this in Django?

hard

A. Set set_expiry(300) on every user request to reset expiry time.

B. Set set_expiry(300) once when the session is created only.

C. Set set_expiry(0) to expire on browser close and ignore activity.

D. Do not set expiry; rely on default session timeout.

Solution

1. Step 1: Understand session expiry reset behavior

   Calling set_expiry(300) on every request resets the expiry countdown, keeping session alive if user is active.

2. Step 2: Evaluate other options

   Set set_expiry(300) once when the session is created only. sets expiry once, so session expires after 5 minutes regardless of activity. Set set_expiry(0) to expire on browser close and ignore activity. expires on browser close, ignoring time. Do not set expiry; rely on default session timeout. uses default timeout, no control.

3. Final Answer:

   Set set_expiry(300) on every user request to reset expiry time. -> Option A

4. Quick Check:

   Reset expiry on each request = Set set_expiry(300) on every user request to reset expiry time. [OK]

Hint: Reset expiry timer on each request to keep session alive [OK]

Common Mistakes:

• Setting expiry only once at session creation
• Using 0 expiry which ignores time
• Relying on default timeout without control