Why Django security matters - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable Django's built-in security feature for cross-site request forgery protection.

Django

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    '[1]',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

Drag options to blanks, or click blank then click option'

A'django.middleware.csrf.CsrfViewMiddleware'

B'django.middleware.cache.UpdateCacheMiddleware'

C'django.middleware.gzip.GZipMiddleware'

D'django.middleware.locale.LocaleMiddleware'

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing middleware unrelated to security like cache or gzip middleware.

Forgetting to include CSRF middleware causes security risks.

The CsrfViewMiddleware protects against cross-site request forgery attacks by checking for a valid token in POST requests.

2fill in blank

medium

Complete the code to set a secure cookie flag in Django settings.

Django

SESSION_COOKIE_SECURE = [1]

Drag options to blanks, or click blank then click option'

AFalse

BTrue

CNone

D'True'

Attempts:

3 left

💡 Hint

Common Mistakes

Using string 'True' instead of boolean True.

Setting it to False disables secure cookie flag.

Setting SESSION_COOKIE_SECURE = True ensures cookies are only sent over HTTPS, improving security.

3fill in blank

hard

Fix the error in the Django settings to prevent clickjacking attacks.

Django

X_FRAME_OPTIONS = [1]

Drag options to blanks, or click blank then click option'

A'DENY'

BDENY

C'SAMEORIGIN'

D'ALLOWALL'

Attempts:

3 left

💡 Hint

Common Mistakes

Using a value without quotes causes a NameError.

Using 'ALLOWALL' disables protection.

Setting X_FRAME_OPTIONS = 'DENY' prevents the site from being framed, protecting against clickjacking.

4fill in blank

hard

Fill both blanks to create a secure password validator in Django settings.

Django

AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.[1]Validator',
        'OPTIONS': {
            'min_length': [2],
        }
    },
]

Drag options to blanks, or click blank then click option'

AMinimumLength

BCommonPassword

C8

DUserAttributeSimilarity

Attempts:

3 left

💡 Hint

Common Mistakes

Using a validator unrelated to length.

Setting min_length to a string instead of a number.

The MinimumLengthValidator enforces a minimum password length, here set to 8 characters for better security.

5fill in blank

hard

Fill all three blanks to configure Django to use HTTPS and secure cookies.

Django

SECURE_SSL_REDIRECT = [1]
SESSION_COOKIE_SECURE = [2]
CSRF_COOKIE_SECURE = [3]

Drag options to blanks, or click blank then click option'

AFalse

BTrue

Attempts:

3 left

💡 Hint

Common Mistakes

Using False disables security features.

Using string 'True' instead of boolean True.

Setting SECURE_SSL_REDIRECT, SESSION_COOKIE_SECURE, and CSRF_COOKIE_SECURE all to True ensures Django redirects HTTP to HTTPS and uses secure cookies.