HTTPS and secure cookies in Django - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable HTTPS redirect in Django settings.

Django

SECURE_SSL_REDIRECT = [1]

Drag options to blanks, or click blank then click option'

ATrue

B1

C"True"

DFalse

Attempts:

3 left

💡 Hint

Common Mistakes

Using string 'True' instead of boolean True

Setting it to False disables HTTPS redirect

Setting SECURE_SSL_REDIRECT to True forces Django to redirect all HTTP requests to HTTPS.

2fill in blank

medium

Complete the code to set the secure flag on cookies in Django settings.

Django

SESSION_COOKIE_SECURE = [1]

Drag options to blanks, or click blank then click option'

AFalse

B"True"

CTrue

D0

Attempts:

3 left

💡 Hint

Common Mistakes

Using string 'True' instead of boolean True

Setting it to False allows cookies over HTTP

Setting SESSION_COOKIE_SECURE to True ensures cookies are only sent over HTTPS.

3fill in blank

hard

Fix the error in the code to set the HTTPOnly flag on cookies.

Django

CSRF_COOKIE_HTTPONLY = [1]

Drag options to blanks, or click blank then click option'

AFalse

B"False"

CTrue

D"True"

Attempts:

3 left

💡 Hint

Common Mistakes

Using strings instead of booleans

Confusing True and False values

The CSRF_COOKIE_HTTPONLY setting should be a boolean. Setting it to False disables HTTPOnly, which is the default.

4fill in blank

hard

Fill both blanks to set the HSTS header with a max age of 1 year and include subdomains.

Django

SECURE_HSTS_SECONDS = [1]
SECURE_HSTS_INCLUDE_SUBDOMAINS = [2]

Drag options to blanks, or click blank then click option'

A31536000

BTrue

CFalse

D86400

Attempts:

3 left

💡 Hint

Common Mistakes

Using too small max age

Not including subdomains

SECURE_HSTS_SECONDS sets the max age for HSTS in seconds (1 year = 31536000 seconds). SECURE_HSTS_INCLUDE_SUBDOMAINS set to True applies HSTS to all subdomains.

5fill in blank

hard

Fill all three blanks to configure secure cookies with HTTPOnly and set the secure proxy SSL header.

Django

SESSION_COOKIE_SECURE = [1]
CSRF_COOKIE_HTTPONLY = [2]
SECURE_PROXY_SSL_HEADER = ([3], 'https')

Drag options to blanks, or click blank then click option'

ATrue

BFalse

C'HTTP_X_FORWARDED_PROTO'

D'HTTPS'

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong header key

Setting CSRF_COOKIE_HTTPONLY to True unnecessarily

Not securing session cookie

Set SESSION_COOKIE_SECURE to True to send cookies only over HTTPS. CSRF_COOKIE_HTTPONLY is set to False to allow JavaScript access if needed. SECURE_PROXY_SSL_HEADER uses 'HTTP_X_FORWARDED_PROTO' to detect HTTPS behind a proxy.