Clickjacking protection in Django - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to add clickjacking protection middleware in Django settings.

Django

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    [1],
    'django.middleware.common.CommonMiddleware',
]

Drag options to blanks, or click blank then click option'

A'django.middleware.csrf.CsrfViewMiddleware'

B'django.middleware.sessions.SessionMiddleware'

C'django.middleware.clickjacking.XFrameOptionsMiddleware'

D'django.middleware.locale.LocaleMiddleware'

Attempts:

3 left

💡 Hint

Common Mistakes

Using CSRF middleware instead of clickjacking middleware.

Forgetting to add the middleware at all.

The XFrameOptionsMiddleware is the middleware that adds clickjacking protection by setting the X-Frame-Options header.

2fill in blank

medium

Complete the code to set the X-Frame-Options header to deny all framing.

Django

X_FRAME_OPTIONS = [1]

Drag options to blanks, or click blank then click option'

A"DENY"

B"SAMEORIGIN"

C"ALLOW-FROM"

D"NONE"

Attempts:

3 left

💡 Hint

Common Mistakes

Using "ALLOW-FROM" without specifying a domain.

Using "NONE" which is not a valid option.

Setting X_FRAME_OPTIONS to "DENY" prevents any site from framing your pages, protecting against clickjacking.

3fill in blank

hard

Fix the error in the middleware list to correctly protect against clickjacking.

Django

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    [1],
    'django.middleware.common.CommonMiddleware',
]

Drag options to blanks, or click blank then click option'

A'django.middleware.clickjacking.XFrameOptionsMiddleWare'

B'django.middleware.clickjacking.XFrameOptionsMiddleware'

C'django.middleware.clickjack.XFrameOptionsMiddleware'

D'django.middleware.clickjacking.XFrameOptionMiddleware'

Attempts:

3 left

💡 Hint

Common Mistakes

Typos in middleware path causing import errors.

Incorrect casing in middleware name.

The correct middleware name is 'django.middleware.clickjacking.XFrameOptionsMiddleware'. The other options have typos causing errors.

4fill in blank

hard

Fill both blanks to set X-Frame-Options to allow framing only from the same origin.

Django

X_FRAME_OPTIONS = [1]

# Common allowed host for development
ALLOWED_HOSTS = [[2]]

Drag options to blanks, or click blank then click option'

A"SAMEORIGIN"

B"DENY"

C"example.com"

D"localhost"

Attempts:

3 left

💡 Hint

Common Mistakes

Using "DENY" which blocks all framing, not allowing same origin.

Using a domain name that doesn't match the development environment.

Setting X_FRAME_OPTIONS to "SAMEORIGIN" allows framing only from the same site. "localhost" is a common allowed host during development.

5fill in blank

hard

Fill all three blanks to create a custom middleware that sets X-Frame-Options header to SAMEORIGIN.

Django

from django.utils.deprecation import MiddlewareMixin

class ClickjackingProtectionMiddleware(MiddlewareMixin):
    def process_response(self, request, response):
        response[[1]] = [2]
        return response

# Add this middleware to settings MIDDLEWARE list as [3]

Drag options to blanks, or click blank then click option'

A"X-Frame-Options"

B"SAMEORIGIN"

C'ClickjackingProtectionMiddleware'

D'django.middleware.clickjacking.XFrameOptionsMiddleware'

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect header names or values.

Confusing the custom middleware class name with built-in middleware.

The header name is "X-Frame-Options". The value "SAMEORIGIN" allows framing only from the same site. The custom middleware class name is 'ClickjackingProtectionMiddleware' to add in settings.