Session security considerations in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of Django's SESSION_COOKIE_SECURE setting?

In Django, what does setting SESSION_COOKIE_SECURE = True do to improve session security?

A It automatically logs out users after a fixed time.

B It encrypts the session data stored on the server.

C It ensures the session cookie is only sent over HTTPS connections.

D It stores session data in a secure database table.

💡 Hint

Think about how cookies are transmitted over the network.

Setting SESSION_COOKIE_SECURE = True tells the browser to send the session cookie only over HTTPS, preventing it from being sent over unencrypted connections where it could be intercepted.

❓ component_behavior

intermediate

What happens if SESSION_EXPIRE_AT_BROWSER_CLOSE is set to True?

Consider this Django setting: SESSION_EXPIRE_AT_BROWSER_CLOSE = True. What is the effect on user sessions?

A Sessions persist even if the user clears cookies.

B Sessions expire when the user closes their browser, requiring login again next time.

C Sessions expire after a fixed time regardless of browser state.

D Sessions never expire unless manually cleared by the server.

💡 Hint

Think about how browsers handle session cookies.

When SESSION_EXPIRE_AT_BROWSER_CLOSE is True, Django sets the session cookie without an expiration date, so it is deleted when the browser closes, ending the session.

🔧 Debug

advanced

Why does this Django session code cause a security risk?

Examine this Django middleware snippet that sets session data:

def process_request(self, request):
    request.session['user_role'] = 'admin'

What security risk does this code introduce?

Django

def process_request(self, request):
    request.session['user_role'] = 'admin'

A It exposes the session cookie to JavaScript by default.

B It causes the session to never expire.

C It stores session data in plain text on the client side.

D It overwrites the user role on every request, ignoring actual user permissions.

💡 Hint

Consider what happens if the user role is forced to 'admin' every time.

This code sets the user role to 'admin' on every request, ignoring the real user's permissions. This can allow unauthorized access and privilege escalation.

📝 Syntax

advanced

Which Django session setting prevents JavaScript from accessing the session cookie?

Select the correct Django setting that makes the session cookie inaccessible to JavaScript, improving security against XSS attacks.

A SESSION_COOKIE_HTTPONLY = True

B SESSION_COOKIE_SECURE = False

C SESSION_COOKIE_SAMESITE = 'None'

D SESSION_COOKIE_AGE = 1209600

💡 Hint

Think about cookie flags that restrict client-side script access.

Setting SESSION_COOKIE_HTTPONLY = True prevents JavaScript from accessing the session cookie, reducing risk of theft via cross-site scripting.

❓ state_output

expert

What is the session cookie behavior with these Django settings?

Given these Django settings:

SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_EXPIRE_AT_BROWSER_CLOSE = True

What is the combined effect on the session cookie?

A The cookie is sent only over HTTPS, inaccessible to JavaScript, and deleted when the browser closes.

B The cookie is sent over HTTP and HTTPS, accessible to JavaScript, and persists after browser closes.

C The cookie is sent only over HTTPS, accessible to JavaScript, and persists after browser closes.

D The cookie is sent over HTTP only, inaccessible to JavaScript, and deleted after a fixed time.

💡 Hint

Combine the effects of each setting carefully.

These settings together ensure the session cookie is secure: sent only via HTTPS (SESSION_COOKIE_SECURE), not accessible by JavaScript (SESSION_COOKIE_HTTPONLY), and removed when the browser closes (SESSION_EXPIRE_AT_BROWSER_CLOSE).