Session security considerations in Django - Step-by-Step Execution

Concept Flow - Session security considerations

User logs in

↓

Server creates session ID

↓

Session ID sent to user as cookie

↓

User sends requests with session cookie

↓

Server validates session ID

↓

Access granted or denied

↓

Session expires or user logs out

This flow shows how a session is created, sent, validated, and eventually ended to keep user data secure.

Execution Sample

Django

def login(request):
    user = authenticate_user(request)
    if user:
        request.session['user_id'] = user.id
        request.session.set_expiry(300)  # 5 minutes
        return redirect('home')

This code logs in a user, creates a session with a user ID, and sets the session to expire after 5 minutes.

Execution Table

Step	Action	Session State	Security Check	Result
1	User submits login form	No session	N/A	Authenticate user
2	User authenticated	Create session with user_id	Set session expiry to 300s	Session cookie sent
3	User sends request with session cookie	Session with user_id active	Check session expiry and validity	Access granted
4	User inactive for 5 minutes	Session expired	Session expiry check fails	Access denied, redirect to login
5	User logs out	Session cleared	Session invalidated	User logged out

💡 Session expires after timeout or user logs out, stopping access.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
session['user_id']	None	user.id	user.id	None	None
session expiry	None	300 seconds	300 seconds	Expired	None
session cookie	None	Sent to user	Sent with requests	Expired/Removed	Removed

Key Moments - 3 Insights

Why do we set a session expiry time?

Setting a session expiry limits how long a session stays valid, reducing risk if a session cookie is stolen. See execution_table step 2 and 4 where expiry is set and checked.

What happens if the session cookie is stolen?

If stolen, the attacker can impersonate the user until the session expires or is invalidated. Using HTTPS and HttpOnly cookies helps protect the cookie. This is implied in the session cookie handling in steps 2 and 3.

Why clear the session on logout?

Clearing the session removes all stored data and invalidates the session cookie, preventing reuse. See execution_table step 5 where session is cleared and user logged out.

Visual Quiz - 3 Questions

Look at the execution_table, what is the session state after step 3?

A Session with user_id active

B Session expired

C No session

D Session cleared

💡 Hint

Check the 'Session State' column for step 3 in the execution_table.

At which step does the session expiry cause access to be denied?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Look at the 'Security Check' and 'Result' columns in the execution_table for when expiry fails.

If we remove the session expiry setting, what would change in the execution_table?

A Step 2 would fail to create a session

B Step 4 would not expire the session

C Step 5 would not clear the session

D Step 3 would deny access

💡 Hint

Refer to the 'Session expiry' variable in variable_tracker and step 4 in execution_table.

Concept Snapshot

Session security in Django:
- Server creates a session ID after login
- Session ID stored in secure cookie
- Set session expiry to limit lifetime
- Validate session on each request
- Clear session on logout to prevent reuse

Full Transcript

This visual execution shows how Django manages session security. When a user logs in, the server creates a session with a unique ID and stores the user ID in it. This session ID is sent to the user as a cookie. Each time the user makes a request, the server checks if the session is valid and not expired. Sessions have expiry times to reduce risk if cookies are stolen. When the user logs out or the session expires, the session data is cleared and access is denied. This process helps keep user data safe during web interactions.

Practice

1. Which Django setting helps ensure session cookies are only sent over HTTPS connections?

easy

A. SESSION_EXPIRE_AT_BROWSER_CLOSE

B. SESSION_COOKIE_HTTPONLY

C. SESSION_COOKIE_SECURE

D. SESSION_SAVE_EVERY_REQUEST

Solution

1. Step 1: Understand the purpose of SESSION_COOKIE_SECURE

   This setting makes sure cookies are only sent over HTTPS, protecting them from being sent over insecure connections.

2. Step 2: Compare with other settings

   SESSION_COOKIE_HTTPONLY prevents JavaScript access, SESSION_EXPIRE_AT_BROWSER_CLOSE controls expiration, and SESSION_SAVE_EVERY_REQUEST saves session on every request, none enforce HTTPS.

3. Final Answer:

   SESSION_COOKIE_SECURE -> Option C

4. Quick Check:

   Secure cookie = SESSION_COOKIE_SECURE [OK]

Hint: Secure cookies only with SESSION_COOKIE_SECURE [OK]

Common Mistakes:

• Confusing HTTPOnly with secure flag
• Thinking expiration controls HTTPS
• Assuming saving every request affects security

2. Which of the following is the correct way to set a session cookie to be inaccessible to JavaScript in Django's settings?

easy

A. SESSION_COOKIE_HTTPONLY = True

B. SESSION_COOKIE_HTTPONLY = False

C. SESSION_COOKIE_SECURE = False

D. SESSION_EXPIRE_AT_BROWSER_CLOSE = False

Solution

1. Step 1: Identify the setting controlling JavaScript access

   SESSION_COOKIE_HTTPONLY when set to True prevents JavaScript from accessing the cookie.

2. Step 2: Confirm correct boolean value

   Setting it to True enables this protection; False would allow JavaScript access.

3. Final Answer:

   SESSION_COOKIE_HTTPONLY = True -> Option A

4. Quick Check:

   HTTPOnly true blocks JavaScript [OK]

Hint: HTTPOnly True blocks JavaScript cookie access [OK]

Common Mistakes:

• Setting HTTPOnly to False expecting protection
• Confusing SESSION_COOKIE_SECURE with HTTPOnly
• Mixing expiration settings with cookie flags

3. Given the following Django settings:

SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_EXPIRE_AT_BROWSER_CLOSE = True

What happens to the session cookie when the user closes their browser?

medium

A. The session cookie is sent over HTTP connections.

B. The session cookie is deleted, requiring login again.

C. The session cookie remains until manually cleared.

D. The session cookie becomes accessible to JavaScript.

Solution

1. Step 1: Understand SESSION_EXPIRE_AT_BROWSER_CLOSE

   This setting makes the session cookie expire when the browser closes, deleting it.

2. Step 2: Check other settings' effects

   SESSION_COOKIE_SECURE ensures HTTPS only, SESSION_COOKIE_HTTPONLY blocks JavaScript access, neither affects expiration on close.

3. Final Answer:

   The session cookie is deleted, requiring login again. -> Option B

4. Quick Check:

   Expire at close = cookie deleted [OK]

Hint: Expire at browser close deletes session cookie [OK]

Common Mistakes:

• Thinking cookie persists after browser close
• Confusing secure flag with expiration
• Assuming HTTPOnly affects cookie lifetime

4. You want to ensure that session cookies are not accessible via JavaScript and are only sent over HTTPS. Which of the following Django settings combinations sets both security flags to False?

medium

A. SESSION_COOKIE_HTTPONLY = False and SESSION_COOKIE_SECURE = False

B. SESSION_COOKIE_HTTPONLY = False and SESSION_COOKIE_SECURE = True

C. SESSION_COOKIE_HTTPONLY = True and SESSION_COOKIE_SECURE = False

D. SESSION_COOKIE_HTTPONLY = True and SESSION_COOKIE_SECURE = True

Solution

1. Step 1: Identify required settings for security

   To block JavaScript access, SESSION_COOKIE_HTTPONLY must be True. To send cookies only over HTTPS, SESSION_COOKIE_SECURE must be True.

2. Step 2: Analyze each option

   SESSION_COOKIE_HTTPONLY = False and SESSION_COOKIE_SECURE = False sets both to False, allowing JavaScript access and sending cookies over HTTP, which is insecure.

3. Final Answer:

   SESSION_COOKIE_HTTPONLY = False and SESSION_COOKIE_SECURE = False -> Option A

4. Quick Check:

   Both flags False = insecure [OK]

Hint: Both HTTPOnly and Secure must be True for safety [OK]

Common Mistakes:

• Thinking one flag alone is enough
• Confusing True/False meanings
• Ignoring HTTPS requirement for Secure flag

5. You want to improve session security by expiring sessions after 15 minutes of inactivity and ensuring cookies are secure and inaccessible to JavaScript. Which Django settings combination achieves this correctly?

hard

A. SESSION_COOKIE_SECURE = True, SESSION_COOKIE_HTTPONLY = True, SESSION_EXPIRE_AT_BROWSER_CLOSE = False

B. SESSION_COOKIE_SECURE = False, SESSION_COOKIE_HTTPONLY = True, SESSION_COOKIE_AGE = 900

C. SESSION_COOKIE_SECURE = True, SESSION_COOKIE_HTTPONLY = False, SESSION_COOKIE_AGE = 3600

D. SESSION_COOKIE_SECURE = True, SESSION_COOKIE_HTTPONLY = True, SESSION_COOKIE_AGE = 900

Solution

1. Step 1: Set secure and HTTPOnly flags

   Both SESSION_COOKIE_SECURE and SESSION_COOKIE_HTTPONLY must be True to protect cookies from insecure transport and JavaScript access.

2. Step 2: Set session expiration time

   SESSION_COOKIE_AGE controls session lifetime in seconds; 900 seconds equals 15 minutes, which matches the requirement.

3. Step 3: Verify other options

   The combination with SESSION_EXPIRE_AT_BROWSER_CLOSE = False (without SESSION_COOKIE_AGE) does not provide a 15-minute inactivity timeout. The one with SESSION_COOKIE_SECURE = False allows transmission over HTTP. The one with SESSION_COOKIE_HTTPONLY = False and SESSION_COOKIE_AGE = 3600 permits JavaScript access and uses a 1-hour timeout.

4. Final Answer:

   SESSION_COOKIE_SECURE = True, SESSION_COOKIE_HTTPONLY = True, SESSION_COOKIE_AGE = 900 -> Option D

5. Quick Check:

   Secure + HTTPOnly + 15 min age = SESSION_COOKIE_SECURE = True, SESSION_COOKIE_HTTPONLY = True, SESSION_COOKIE_AGE = 900 [OK]

Hint: Set secure, HTTPOnly true and age to 900 seconds [OK]

Common Mistakes:

• Forgetting to set secure flag to True
• Using wrong expiration time units
• Disabling HTTPOnly accidentally