Security checklist (manage.py check --deploy) in Django - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to run the Django security checklist command.

Django

python manage.py [1] --deploy

Drag options to blanks, or click blank then click option'

Acreatesuperuser

Bcheck

Cmigrate

Drunserver

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'runserver' instead of 'check' will start the server, not check security.

Using 'migrate' or 'createsuperuser' does not perform security checks.

The check command runs system checks, and with --deploy it focuses on security and deployment issues.

2fill in blank

medium

Complete the setting to ensure Django uses HTTPS for cookies.

Django

SESSION_COOKIE_SECURE = [1]

Drag options to blanks, or click blank then click option'

AFalse

BNone

CTrue

D0

Attempts:

3 left

💡 Hint

Common Mistakes

Setting it to False allows cookies over HTTP, which is insecure.

Using None or 0 does not enable secure cookies.

Setting SESSION_COOKIE_SECURE = True tells Django to send cookies only over HTTPS, improving security.

3fill in blank

hard

Fix the error in the setting to prevent clickjacking attacks.

Django

X_FRAME_OPTIONS = '[1]'

Drag options to blanks, or click blank then click option'

ASAMEORIGIN

BDENY

CALLOWALL

DNONE

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'ALLOWALL' disables protection and is insecure.

Using 'DENY' blocks all framing, which might break some features.

Using 'NONE' is not a valid option.

Setting X_FRAME_OPTIONS = 'SAMEORIGIN' prevents your site from being framed by other sites, protecting against clickjacking.

4fill in blank

hard

Fill both blanks to set security headers for HTTPS and content sniffing protection.

Django

SECURE_HSTS_SECONDS = [1]
SECURE_CONTENT_TYPE_NOSNIFF = [2]

Drag options to blanks, or click blank then click option'

A31536000

BTrue

CFalse

D0

Attempts:

3 left

💡 Hint

Common Mistakes

Setting HSTS seconds to 0 disables HTTPS enforcement.

Setting content type nosniff to False disables protection.

SECURE_HSTS_SECONDS sets how long browsers remember to use HTTPS. 31536000 is one year in seconds.
SECURE_CONTENT_TYPE_NOSNIFF = True prevents browsers from guessing content types, improving security.

5fill in blank

hard

Fill all three blanks to configure secure cookies and SSL redirect.

Django

CSRF_COOKIE_SECURE = [1]
SESSION_COOKIE_SECURE = [2]
SECURE_SSL_REDIRECT = [3]

Drag options to blanks, or click blank then click option'

AFalse

BTrue

Attempts:

3 left

💡 Hint

Common Mistakes

Setting any of these to False weakens security.

Confusing CSRF and session cookie settings.

Setting CSRF_COOKIE_SECURE and SESSION_COOKIE_SECURE to True ensures cookies are sent only over HTTPS.
SECURE_SSL_REDIRECT = True forces all HTTP requests to redirect to HTTPS, improving security.

Practice

1. What is the main purpose of running manage.py check --deploy in a Django project?

easy

A. To create a new database migration

B. To start the Django development server

C. To find security issues before deploying the site to production

D. To install required Python packages

Solution

1. Step 1: Understand the command's role

   manage.py check --deploy runs checks specifically for security and deployment readiness.

2. Step 2: Compare with other commands

   Other commands like migrations or server start do not check security issues.

3. Final Answer:

   To find security issues before deploying the site to production -> Option C

4. Quick Check:

   Security check = B [OK]

Hint: Remember: --deploy means check for production security [OK]

Common Mistakes:

• Confusing it with migration commands
• Thinking it starts the server
• Assuming it installs packages

2. Which of the following is the correct way to run the security deployment check in Django?

easy

A. python manage.py startapp --deploy

B. python manage.py migrate --deploy

C. python manage.py runserver --deploy

D. python manage.py check --deploy

Solution

1. Step 1: Identify the correct command syntax

   The command to check security issues is python manage.py check --deploy.

2. Step 2: Eliminate incorrect options

   Other commands like migrate, runserver, or startapp do not accept --deploy and serve different purposes.

3. Final Answer:

   python manage.py check --deploy -> Option D

4. Quick Check:

   Correct command syntax = A [OK]

Hint: Use 'check' command with --deploy flag for security checks [OK]

Common Mistakes:

• Using migrate or runserver with --deploy
• Mixing up command names
• Omitting 'python' or 'manage.py'

3. After running python manage.py check --deploy, you see a warning about SECURE_SSL_REDIRECT not being set. What will happen if you ignore this warning?

medium

A. Your site will not redirect HTTP requests to HTTPS, risking insecure connections

B. Your database migrations will fail

C. Your static files will not load

D. Your admin login page will be disabled

Solution

1. Step 1: Understand the warning about SECURE_SSL_REDIRECT

   This setting forces HTTP requests to redirect to HTTPS, securing data in transit.

2. Step 2: Consequences of ignoring the warning

   If not set, users can connect over insecure HTTP, exposing sensitive data.

3. Final Answer:

   Your site will not redirect HTTP requests to HTTPS, risking insecure connections -> Option A

4. Quick Check:

   SSL redirect missing = insecure HTTP allowed [OK]

Hint: SSL redirect warning means HTTP stays open, fix it! [OK]

Common Mistakes:

• Thinking it affects database or static files
• Assuming admin page disables automatically
• Ignoring HTTPS importance

4. You ran python manage.py check --deploy and got this error: "Your SECRET_KEY is not set or is insecure." What is the best way to fix this?

medium

A. Set a long, random SECRET_KEY in your settings and keep it secret

B. Remove the SECRET_KEY setting from your settings file

C. Set SECRET_KEY to 'django-insecure' for simplicity

D. Ignore the warning; it only affects development

Solution

1. Step 1: Understand SECRET_KEY importance

   SECRET_KEY is used for cryptographic signing and must be unique and secret.

2. Step 2: Fix by setting a strong, random key

   Generate a long random string and set it in settings securely; do not share it.

3. Final Answer:

   Set a long, random SECRET_KEY in your settings and keep it secret -> Option A

4. Quick Check:

   Strong SECRET_KEY = A [OK]

Hint: Never share SECRET_KEY; generate a strong random one [OK]

Common Mistakes:

• Using default insecure keys
• Removing SECRET_KEY setting
• Ignoring warnings thinking they're only for dev

5. You want to ensure your Django app is secure for production. Which combination of settings should you verify or enable after running manage.py check --deploy?

hard

A. Remove ALLOWED_HOSTS, set DEBUG=True, and disable security middleware

B. Set SECURE_SSL_REDIRECT=True, SESSION_COOKIE_SECURE=True, and DEBUG=False

C. Set DEBUG=True, ALLOWED_HOSTS=['*'], and CSRF_COOKIE_SECURE=False

D. Keep DEBUG=True, set SECURE_HSTS_SECONDS=0, and disable SSL redirect

Solution

1. Step 1: Identify secure production settings

   SECURE_SSL_REDIRECT and SESSION_COOKIE_SECURE enforce HTTPS and secure cookies; DEBUG must be False in production.

2. Step 2: Eliminate insecure options

   Options with DEBUG=True or ALLOWED_HOSTS=['*'] are insecure and should be avoided.

3. Final Answer:

   Set SECURE_SSL_REDIRECT=True, SESSION_COOKIE_SECURE=True, and DEBUG=False -> Option B

4. Quick Check:

   Secure settings = C [OK]

Hint: Disable DEBUG and enable SSL redirect for production [OK]

Common Mistakes:

• Leaving DEBUG=True in production
• Allowing all hosts with ALLOWED_HOSTS=['*']
• Disabling security middleware