Security checklist (manage.py check --deploy) in Django - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to run the Django security checklist command.

Django

python manage.py [1] --deploy

Drag options to blanks, or click blank then click option'

Acreatesuperuser

Bcheck

Cmigrate

Drunserver

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'runserver' instead of 'check' will start the server, not check security.

Using 'migrate' or 'createsuperuser' does not perform security checks.

The check command runs system checks, and with --deploy it focuses on security and deployment issues.

2fill in blank

medium

Complete the setting to ensure Django uses HTTPS for cookies.

Django

SESSION_COOKIE_SECURE = [1]

Drag options to blanks, or click blank then click option'

AFalse

BNone

CTrue

D0

Attempts:

3 left

💡 Hint

Common Mistakes

Setting it to False allows cookies over HTTP, which is insecure.

Using None or 0 does not enable secure cookies.

Setting SESSION_COOKIE_SECURE = True tells Django to send cookies only over HTTPS, improving security.

3fill in blank

hard

Fix the error in the setting to prevent clickjacking attacks.

Django

X_FRAME_OPTIONS = '[1]'

Drag options to blanks, or click blank then click option'

ASAMEORIGIN

BDENY

CALLOWALL

DNONE

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'ALLOWALL' disables protection and is insecure.

Using 'DENY' blocks all framing, which might break some features.

Using 'NONE' is not a valid option.

Setting X_FRAME_OPTIONS = 'SAMEORIGIN' prevents your site from being framed by other sites, protecting against clickjacking.

4fill in blank

hard

Fill both blanks to set security headers for HTTPS and content sniffing protection.

Django

SECURE_HSTS_SECONDS = [1]
SECURE_CONTENT_TYPE_NOSNIFF = [2]

Drag options to blanks, or click blank then click option'

A31536000

BTrue

CFalse

D0

Attempts:

3 left

💡 Hint

Common Mistakes

Setting HSTS seconds to 0 disables HTTPS enforcement.

Setting content type nosniff to False disables protection.

SECURE_HSTS_SECONDS sets how long browsers remember to use HTTPS. 31536000 is one year in seconds.
SECURE_CONTENT_TYPE_NOSNIFF = True prevents browsers from guessing content types, improving security.

5fill in blank

hard

Fill all three blanks to configure secure cookies and SSL redirect.

Django

CSRF_COOKIE_SECURE = [1]
SESSION_COOKIE_SECURE = [2]
SECURE_SSL_REDIRECT = [3]

Drag options to blanks, or click blank then click option'

AFalse

BTrue

Attempts:

3 left

💡 Hint

Common Mistakes

Setting any of these to False weakens security.

Confusing CSRF and session cookie settings.

Setting CSRF_COOKIE_SECURE and SESSION_COOKIE_SECURE to True ensures cookies are sent only over HTTPS.
SECURE_SSL_REDIRECT = True forces all HTTP requests to redirect to HTTPS, improving security.