Why Django security matters - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why is CSRF protection important in Django?

Django includes built-in CSRF protection. What is the main reason this security feature is important?

A It prevents attackers from tricking users into submitting unwanted requests on their behalf.

B It encrypts all data sent between the user and the server.

C It blocks users from accessing pages without logging in.

D It automatically updates Django to the latest secure version.

💡 Hint

Think about what happens if a user unknowingly sends a harmful request.

CSRF protection stops attackers from making users perform actions they did not intend, like changing passwords or making purchases.

❓ component_behavior

intermediate

What happens if DEBUG=True in production?

In Django settings, what is the risk of leaving DEBUG=True when your site is live?

A Users cannot log in until DEBUG is set to False.

B The site runs faster because debugging is enabled.

C Detailed error pages with sensitive information are shown to all users.

D Static files are not served correctly.

💡 Hint

Consider what information error pages might reveal.

When DEBUG=True, error pages show detailed info like file paths and settings, which attackers can use to find weaknesses.

📝 Syntax

advanced

Which middleware enables Django's security features?

Select the correct middleware line to add in MIDDLEWARE for security headers.

A 'django.middleware.csrf.CsrfViewMiddleware',

B 'django.middleware.security.SecurityMiddleware',

C 'django.middleware.clickjacking.XFrameOptionsMiddleware',

D 'django.middleware.common.CommonMiddleware',

💡 Hint

This middleware adds headers like HSTS and others for security.

SecurityMiddleware adds important security headers and helps enforce HTTPS.

🔧 Debug

advanced

What error occurs if SECRET_KEY is missing?

If you remove or leave empty the SECRET_KEY in Django settings, what error will you see when running the server?

A SyntaxError: invalid syntax in settings.py

B ModuleNotFoundError: No module named 'secret_key'

C AttributeError: 'NoneType' object has no attribute 'encode'

D django.core.exceptions.ImproperlyConfigured: The SECRET_KEY setting must not be empty.

💡 Hint

SECRET_KEY is required for cryptographic signing.

Django raises ImproperlyConfigured if SECRET_KEY is missing or empty because it is essential for security.

❓ state_output

expert

What is the output of this Django view with improper user input handling?

Consider this Django view code snippet:

from django.http import HttpResponse

def greet(request):
    name = request.GET.get('name', 'Guest')
    return HttpResponse(f"Hello, {name}!")

What security risk does this code have and what will be the output if a user visits /greet?name=<script>alert('XSS')</script>?

Django

from django.http import HttpResponse

def greet(request):
    name = request.GET.get('name', 'Guest')
    return HttpResponse(f"Hello, {name}!")

A The output will be <code>Hello, &lt;script&gt;alert('XSS')&lt;/script&gt;!</code> and it causes a cross-site scripting (XSS) vulnerability.

B The output will be <code>Hello, Guest!</code> because Django automatically escapes input.

C The server will raise a ValueError due to unsafe characters in the URL.

D The output will be <code>Hello, &lt;script&gt;alert('XSS')&lt;/script&gt;!</code> but no security risk exists.

💡 Hint

Think about how raw user input is handled in HttpResponse.

This code directly inserts user input into the response without escaping, allowing malicious scripts to run in the browser.