Session security considerations in Django - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of using secure cookies in Django sessions?

Secure cookies ensure that session cookies are only sent over HTTPS connections, protecting session data from being intercepted on unsecured networks.

beginner

How does Django's SESSION_COOKIE_HTTPONLY setting improve session security?

Setting SESSION_COOKIE_HTTPONLY to True prevents JavaScript from accessing the session cookie, reducing the risk of cross-site scripting (XSS) attacks stealing session data.

intermediate

Why should session expiration be configured carefully in Django?

Proper session expiration limits the time a session remains valid, reducing the window for attackers to reuse stolen session IDs and improving overall security.

intermediate

What is session fixation and how can Django help prevent it?

Session fixation is an attack where an attacker sets a user's session ID to a known value. Django helps prevent this by rotating the session key after login using the cycle_key() method on the session object.

beginner

Explain the role of CSRF protection in session security within Django.

CSRF protection prevents unauthorized commands from being transmitted from a user that the web application trusts. Django includes built-in CSRF tokens that work with sessions to protect against such attacks.

Which Django setting ensures session cookies are only sent over HTTPS?

A SESSION_EXPIRE_AT_BROWSER_CLOSE

B SESSION_COOKIE_HTTPONLY

C CSRF_COOKIE_SECURE

D SESSION_COOKIE_SECURE

SESSION_COOKIE_SECURE makes sure cookies are sent only over HTTPS, protecting session data during transmission.

What does setting SESSION_COOKIE_HTTPONLY to True do?

A Prevents JavaScript access to session cookies

B Expires session cookies immediately

C Allows cookies on all domains

D Encrypts session data in the database

SESSION_COOKIE_HTTPONLY prevents JavaScript from reading the session cookie, reducing XSS attack risks.

How can Django help prevent session fixation attacks?

A By using HTTP instead of HTTPS

B By rotating the session key after login

C By setting SESSION_COOKIE_AGE to zero

D By disabling sessions entirely

Django's cycle_key() method changes the session key after login to prevent attackers from fixing a session ID.

Why is it important to set session expiration in Django?

A To limit how long a session stays valid

B To allow unlimited session duration

C To disable session cookies

D To enable JavaScript access to cookies

Setting session expiration limits the time an attacker can reuse a stolen session ID.

What role does CSRF protection play in session security?

A Encrypts session cookies

B Disables session cookies

C Prevents unauthorized commands from trusted users

D Allows cross-site requests without tokens

CSRF protection uses tokens to ensure requests are from trusted users, protecting sessions from malicious commands.

Describe three key settings or practices in Django that help secure user sessions.

Think about cookie security, session lifetime, and login behavior.

Explain how session fixation attacks work and how Django defends against them.

Focus on session ID control before and after login.