Why Django security matters - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable Django's built-in security feature for cross-site request forgery protection.

Django

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    '[1]',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

Drag options to blanks, or click blank then click option'

A'django.middleware.csrf.CsrfViewMiddleware'

B'django.middleware.cache.UpdateCacheMiddleware'

C'django.middleware.gzip.GZipMiddleware'

D'django.middleware.locale.LocaleMiddleware'

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing middleware unrelated to security like cache or gzip middleware.

Forgetting to include CSRF middleware causes security risks.

The CsrfViewMiddleware protects against cross-site request forgery attacks by checking for a valid token in POST requests.

2fill in blank

medium

Complete the code to set a secure cookie flag in Django settings.

Django

SESSION_COOKIE_SECURE = [1]

Drag options to blanks, or click blank then click option'

AFalse

BTrue

CNone

D'True'

Attempts:

3 left

💡 Hint

Common Mistakes

Using string 'True' instead of boolean True.

Setting it to False disables secure cookie flag.

Setting SESSION_COOKIE_SECURE = True ensures cookies are only sent over HTTPS, improving security.

3fill in blank

hard

Fix the error in the Django settings to prevent clickjacking attacks.

Django

X_FRAME_OPTIONS = [1]

Drag options to blanks, or click blank then click option'

A'DENY'

BDENY

C'SAMEORIGIN'

D'ALLOWALL'

Attempts:

3 left

💡 Hint

Common Mistakes

Using a value without quotes causes a NameError.

Using 'ALLOWALL' disables protection.

Setting X_FRAME_OPTIONS = 'DENY' prevents the site from being framed, protecting against clickjacking.

4fill in blank

hard

Fill both blanks to create a secure password validator in Django settings.

Django

AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.[1]Validator',
        'OPTIONS': {
            'min_length': [2],
        }
    },
]

Drag options to blanks, or click blank then click option'

AMinimumLength

BCommonPassword

C8

DUserAttributeSimilarity

Attempts:

3 left

💡 Hint

Common Mistakes

Using a validator unrelated to length.

Setting min_length to a string instead of a number.

The MinimumLengthValidator enforces a minimum password length, here set to 8 characters for better security.

5fill in blank

hard

Fill all three blanks to configure Django to use HTTPS and secure cookies.

Django

SECURE_SSL_REDIRECT = [1]
SESSION_COOKIE_SECURE = [2]
CSRF_COOKIE_SECURE = [3]

Drag options to blanks, or click blank then click option'

AFalse

BTrue

Attempts:

3 left

💡 Hint

Common Mistakes

Using False disables security features.

Using string 'True' instead of boolean True.

Setting SECURE_SSL_REDIRECT, SESSION_COOKIE_SECURE, and CSRF_COOKIE_SECURE all to True ensures Django redirects HTTP to HTTPS and uses secure cookies.

Practice

1. Why is it important to use Django's built-in security features when developing a website?

easy

A. They help protect the site and users from common web attacks.

B. They make the website load faster.

C. They automatically add more colors to the website design.

D. They reduce the size of the website's images.

Solution

1. Step 1: Understand Django's security purpose

   Django's built-in security features are designed to protect websites from threats like hacking and data theft.

2. Step 2: Identify the main benefit

   These features help keep both the website and its users safe from common web attacks.

3. Final Answer:

   They help protect the site and users from common web attacks. -> Option A

4. Quick Check:

   Django security = protect site and users [OK]

Hint: Security features protect users and data from attacks [OK]

Common Mistakes:

• Thinking security features improve speed
• Confusing security with design improvements
• Assuming security features handle images

2. Which of the following is the correct way to enable Django's Cross-Site Request Forgery (CSRF) protection in a template?

easy

A. {% csrf_token %} outside the form tag

B. <csrf_token> inside the form tag

C. {% csrf_token %} inside the form tag

D. without template tag

Solution

1. Step 1: Recall Django CSRF protection syntax

   Django requires the template tag {% csrf_token %} inside the form to add a hidden CSRF token field.

2. Step 2: Identify correct placement

   The token must be inside the form tag to be submitted with the form data.

3. Final Answer:

   {% csrf_token %} inside the form tag -> Option C

4. Quick Check:

   CSRF token tag inside form = correct [OK]

Hint: Use {% csrf_token %} inside form tags for CSRF protection [OK]

Common Mistakes:

• Placing {% csrf_token %} outside the form
• Using incorrect HTML tags for CSRF
• Omitting the token entirely

3. What will happen if you set DEBUG = true in your Django settings on a live website?

medium

A. The website will run faster and be more secure.

B. Detailed error pages will be shown, exposing sensitive information.

C. Django will automatically block all attacks.

D. Users will see a maintenance page.

Solution

1. Step 1: Understand DEBUG setting purpose

   DEBUG=true shows detailed error pages useful for development but risky for live sites.

2. Step 2: Identify risk on live site

   These error pages can reveal sensitive info like database details to attackers.

3. Final Answer:

   Detailed error pages will be shown, exposing sensitive information. -> Option B

4. Quick Check:

   DEBUG=true on live = info leak [OK]

Hint: Never use DEBUG=true on live sites to avoid info leaks [OK]

Common Mistakes:

• Thinking DEBUG=true improves security
• Assuming DEBUG=true blocks attacks
• Confusing DEBUG with maintenance mode

4. You notice your Django site is vulnerable to SQL injection attacks. Which of the following is the most likely cause?

medium

A. Using raw SQL queries without parameterization.

B. Forgetting to add {% csrf_token %} in forms.

C. Setting ALLOWED_HOSTS to ['*'].

D. Using Django's ORM for database queries.

Solution

1. Step 1: Identify cause of SQL injection

   SQL injection happens when raw SQL queries include user input without safe parameterization.

2. Step 2: Evaluate options

   Using Django's ORM prevents SQL injection; forgetting CSRF token or ALLOWED_HOSTS misconfigurations cause other issues.

3. Final Answer:

   Using raw SQL queries without parameterization. -> Option A

4. Quick Check:

   Unsafe raw SQL = SQL injection risk [OK]

Hint: Avoid raw SQL; use ORM or parameterized queries [OK]

Common Mistakes:

• Confusing CSRF with SQL injection
• Thinking ALLOWED_HOSTS affects SQL injection
• Believing ORM causes SQL injection

5. You want to ensure your Django site uses HTTPS and prevents clickjacking attacks. Which combination of settings should you configure?

hard

A. Use raw SQL queries and set SECURE_HSTS_SECONDS = 0.

B. Set DEBUG = true and add 'django.middleware.security.SecurityMiddleware' to MIDDLEWARE.

C. Set ALLOWED_HOSTS = ['*'] and disable CSRF protection.

D. Set SECURE_SSL_REDIRECT = true and add 'django.middleware.clickjacking.XFrameOptionsMiddleware' to MIDDLEWARE.

Solution

1. Step 1: Enable HTTPS redirection

   Setting SECURE_SSL_REDIRECT = true forces all HTTP requests to HTTPS, securing data in transit.

2. Step 2: Prevent clickjacking

   Adding 'django.middleware.clickjacking.XFrameOptionsMiddleware' sets headers to stop the site from being framed by others.

3. Final Answer:

   Set SECURE_SSL_REDIRECT = true and add 'django.middleware.clickjacking.XFrameOptionsMiddleware' to MIDDLEWARE. -> Option D

4. Quick Check:

   HTTPS redirect + clickjacking middleware = secure site [OK]

Hint: Use SSL redirect and clickjacking middleware for HTTPS and framing [OK]

Common Mistakes:

• Enabling DEBUG on live for security
• Allowing all hosts without restrictions
• Disabling CSRF protection mistakenly