HTTPS and secure cookies in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What does setting SECURE_SSL_REDIRECT = True do in Django?

In a Django project, what is the effect of setting SECURE_SSL_REDIRECT = True in your settings.py file?

A It forces all HTTP requests to be redirected to HTTPS.

B It disables HTTPS and allows only HTTP connections.

C It encrypts cookies automatically without any other settings.

D It enables debug mode for SSL connections.

💡 Hint

Think about what happens when a user tries to access your site with HTTP.

Setting SECURE_SSL_REDIRECT = True tells Django to redirect all incoming HTTP requests to HTTPS, ensuring secure connections.

❓ component_behavior

intermediate

What happens if SESSION_COOKIE_SECURE is set to True?

In Django, if you set SESSION_COOKIE_SECURE = True, what is the behavior of the session cookie?

A The session cookie is sent over both HTTP and HTTPS.

B The session cookie is only sent over HTTPS connections.

C The session cookie is disabled completely.

D The session cookie is encrypted with a custom key.

💡 Hint

Consider when cookies are sent by browsers based on security flags.

When SESSION_COOKIE_SECURE is True, browsers send the session cookie only over HTTPS, protecting it from being sent over insecure HTTP.

📝 Syntax

advanced

Identify the correct way to set a secure cookie in a Django view

Which of the following Django view code snippets correctly sets a secure cookie named 'token' with value 'abc123'?

A response.set_cookie('token', 'abc123', httpOnly=True)

B response.set_cookie('token', 'abc123', secure=False, httponly=True)

C response.set_cookie('token', 'abc123', secure=True, httponly=True)

D response.set_cookie('token', 'abc123', secure=True, http_only=True)

💡 Hint

Check the exact parameter names for set_cookie method.

The set_cookie method uses secure and httponly (all lowercase) parameters to set cookie flags. Option C uses correct parameter names and values.

🔧 Debug

advanced

Why is the secure cookie not sent over HTTPS?

A developer sets SESSION_COOKIE_SECURE = True in Django settings but notices the session cookie is not sent in HTTPS requests. What is the most likely cause?

A The SESSION_COOKIE_SECURE setting must be set to False to send cookies.

B The cookie name is incorrect in the settings.

C The browser does not support secure cookies.

D The site is accessed via HTTP, not HTTPS, so the cookie is not sent.

💡 Hint

Think about when secure cookies are sent by browsers.

Secure cookies are only sent over HTTPS connections. If the site is accessed via HTTP, the cookie will not be sent.

❓ state_output

expert

What is the value of CSRF_COOKIE_SECURE after this settings change?

Given the following Django settings snippet, what is the value of CSRF_COOKIE_SECURE after execution?

CSRF_COOKIE_SECURE = False
if DEBUG is False:
    CSRF_COOKIE_SECURE = True
else:
    CSRF_COOKIE_SECURE = False

DEBUG = False

Django

DEBUG = False
CSRF_COOKIE_SECURE = False
if DEBUG is False:
    CSRF_COOKIE_SECURE = True
else:
    CSRF_COOKIE_SECURE = False

A Raises NameError

B True

C False

D None

💡 Hint

Check the order of variable assignments and usage.

The variable DEBUG is used before it is assigned, causing a NameError.