HTTPS and secure cookies in Django - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does HTTPS stand for and why is it important?

HTTPS stands for HyperText Transfer Protocol Secure. It encrypts data between the user's browser and the server, protecting sensitive information from being intercepted.

beginner

What is a secure cookie in Django?

A secure cookie is a cookie that is only sent over HTTPS connections. In Django, setting the 'SESSION_COOKIE_SECURE' or 'CSRF_COOKIE_SECURE' to True ensures cookies are sent securely.

intermediate

How do you enable HTTPS in a Django project?

You enable HTTPS by configuring your web server (like Nginx or Apache) with SSL certificates and setting Django settings like 'SECURE_SSL_REDIRECT = True' to force HTTPS.

intermediate

What does the 'HttpOnly' flag do for cookies?

The 'HttpOnly' flag prevents JavaScript from accessing the cookie, reducing the risk of cross-site scripting (XSS) attacks. In Django, set 'SESSION_COOKIE_HTTPONLY = True'.

advanced

Why should you use 'SECURE_HSTS_SECONDS' in Django settings?

Setting 'SECURE_HSTS_SECONDS' enables HTTP Strict Transport Security (HSTS), telling browsers to only use HTTPS for your site for a set time, improving security.

Which Django setting forces all requests to use HTTPS?

A SECURE_HSTS_SECONDS

B SESSION_COOKIE_SECURE

C CSRF_COOKIE_SECURE

D SECURE_SSL_REDIRECT

SECURE_SSL_REDIRECT = True makes Django redirect all HTTP requests to HTTPS.

What does setting 'SESSION_COOKIE_SECURE = True' do?

A Sends session cookies only over HTTPS

B Makes cookies accessible to JavaScript

C Disables cookies

D Encrypts cookie content

It ensures session cookies are sent only over secure HTTPS connections.

What is the purpose of the 'HttpOnly' flag on cookies?

A Makes cookies visible to all domains

B Prevents JavaScript access to cookies

C Allows cookies over HTTP only

D Encrypts cookies

HttpOnly prevents JavaScript from reading cookies, improving security.

Which protocol does HTTPS use to secure communication?

A SMTP

B FTP

C SSL/TLS

D HTTP/2

HTTPS uses SSL/TLS protocols to encrypt data between client and server.

What does setting 'SECURE_HSTS_SECONDS' do in Django?

A Enforces browsers to use HTTPS for a set time

B Disables cookies

C Redirects HTTP to HTTPS immediately

D Enables HTTP caching

It tells browsers to only connect via HTTPS for the specified number of seconds.

Explain how HTTPS and secure cookies work together to protect user data in a Django application.

Think about data safety during transmission and cookie security.

Describe the key Django settings you would configure to ensure your site uses HTTPS and secure cookies.

Focus on settings that control HTTPS enforcement and cookie security.