Security checklist (manage.py check --deploy) in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What does manage.py check --deploy do in Django?

When you run manage.py check --deploy in a Django project, what is the main purpose of this command?

A It starts the Django development server with extra debugging enabled.

B It runs a security-focused system check to identify potential deployment issues.

C It automatically fixes all security issues found in the project settings.

D It deletes all temporary files and caches before deployment.

💡 Hint

Think about what 'check' commands usually do and what '--deploy' might imply.

The manage.py check --deploy command runs a set of security checks to help you find common deployment mistakes in your Django settings. It does not fix issues automatically or start servers.

📝 Syntax

intermediate

Which setting causes manage.py check --deploy to warn about missing HTTPS?

Given the following Django settings, which one will cause manage.py check --deploy to raise a warning about HTTPS security?

Django

SECURE_SSL_REDIRECT = False
SESSION_COOKIE_SECURE = False
CSRF_COOKIE_SECURE = False
SECURE_HSTS_SECONDS = 0

A SECURE_SSL_REDIRECT = False

B SESSION_COOKIE_SECURE = True

C CSRF_COOKIE_SECURE = True

D SECURE_HSTS_SECONDS = 3600

💡 Hint

Which setting controls redirecting HTTP to HTTPS?

If SECURE_SSL_REDIRECT is False, Django warns that HTTP requests are not redirected to HTTPS, which is a security risk.

🔧 Debug

advanced

Why does manage.py check --deploy warn about DEBUG=True?

Consider a Django project with DEBUG = True in production. What is the reason manage.py check --deploy warns about this?

A Because <code>DEBUG=True</code> prevents static files from loading.

B Because <code>DEBUG=True</code> disables database migrations.

C Because <code>DEBUG=True</code> automatically enables HTTPS.

D Because <code>DEBUG=True</code> exposes detailed error pages that can leak sensitive information.

💡 Hint

Think about what happens when an error occurs and DEBUG is on.

When DEBUG=True, Django shows detailed error pages with stack traces and environment info. This can reveal secrets to attackers, so it is unsafe in production.

❓ state_output

advanced

What is the effect of setting SECURE_HSTS_SECONDS to a positive value?

In Django settings, what happens when you set SECURE_HSTS_SECONDS to a positive integer like 3600?

A It enables debug logging for HTTPS requests.

B Django will redirect all HTTP requests to HTTPS immediately.

C Browsers will remember to only use HTTPS for your site for the given number of seconds.

D It disables CSRF protection for the specified time.

💡 Hint

Think about what HSTS means in web security.

HSTS (HTTP Strict Transport Security) tells browsers to only use HTTPS for your site for the specified time, improving security by preventing downgrade attacks.

🧠 Conceptual

expert

Which setting prevents JavaScript from accessing cookies in Django?

To protect cookies from being accessed by JavaScript (helping prevent XSS attacks), which Django setting should be set to True?

A SESSION_COOKIE_HTTPONLY

B SESSION_COOKIE_SECURE

C CSRF_COOKIE_SECURE

D SECURE_SSL_REDIRECT

💡 Hint

Which cookie flag blocks JavaScript access?

Setting SESSION_COOKIE_HTTPONLY=True marks the cookie as HTTPOnly, so JavaScript cannot read it, reducing risk of cross-site scripting attacks.