Session security considerations in Django - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to set a secure session cookie in Django settings.

Django

SESSION_COOKIE_[1] = True

Drag options to blanks, or click blank then click option'

Adomain

Bhttp_only

Csecure

Dage

Attempts:

3 left

💡 Hint

Common Mistakes

Using SESSION_COOKIE_HTTPONLY instead of SESSION_COOKIE_SECURE

Setting SESSION_COOKIE_SECURE to False

Setting SESSION_COOKIE_SECURE to True ensures cookies are sent only over HTTPS.

2fill in blank

medium

Complete the code to prevent JavaScript access to session cookies.

Django

SESSION_COOKIE_[1] = True

Drag options to blanks, or click blank then click option'

Asecure

Bdomain

Cpath

Dhttp_only

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing SESSION_COOKIE_SECURE with SESSION_COOKIE_HTTPONLY

Leaving this setting as False

Setting SESSION_COOKIE_HTTPONLY to True prevents JavaScript from accessing the cookie, reducing XSS risks.

3fill in blank

hard

Fix the error in the middleware setting to enable session security.

Django

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    '[1]',
]

Drag options to blanks, or click blank then click option'

A'django.middleware.csrf.CsrfViewMiddleware'

B'django.middleware.common.CommonMiddleware'

C'django.middleware.locale.LocaleMiddleware'

D'django.middleware.clickjacking.XFrameOptionsMiddleware'

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting CSRF middleware

Adding unrelated middleware instead

Including CsrfViewMiddleware helps protect sessions from CSRF attacks.

4fill in blank

hard

Fill both blanks to configure session expiration and cookie age.

Django

SESSION_COOKIE_[1] = 1209600  # Two weeks in seconds
SESSION_EXPIRE_AT_[2] = True

Drag options to blanks, or click blank then click option'

Aage

Bbrowser_close

Csecure

Dhttp_only

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up SESSION_COOKIE_AGE with secure flags

Using wrong suffixes for expiration settings

SESSION_COOKIE_AGE sets how long the cookie lasts. SESSION_EXPIRE_AT_BROWSER_CLOSE makes the session end when the browser closes.

5fill in blank

hard

Fill all three blanks to create a secure session dictionary comprehension filtering active sessions.

Django

active_sessions = {session.session_key: session for session in sessions if session.expire_date [1] timezone.now() and session.session_key [2] None and session.user_id [3] 0}

Drag options to blanks, or click blank then click option'

A>

B!=

C>=

D==

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong comparison operators

Checking for equality instead of inequality

The code filters sessions where expiration is in the future (>), session key exists (!= None), and user ID is valid (>= 0).