Django Django Authentication & Security 2

Question 1

What is Django's `AbstractUser` model used for?

Accepted Answer

Extending the built-in User model with additional fields while keeping all default auth features

Answer

AbstractUser allows you to add custom fields to Django's built-in user model by subclassing it, which is the recommended approach for custom user models.

Question 2

What does `logout(request)` do in Django?

Accepted Answer

Clears the authenticated user from the session and flushes session data

Answer

logout() removes the user's session data, ensuring they are fully logged out and protecting against session fixation attacks.

Question 3

What is the purpose of Django's `SecurityMiddleware`?

Accepted Answer

Sets security headers like HSTS, X-Content-Type-Options, and enforces HTTPS

Answer

SecurityMiddleware handles several security-related HTTP headers and redirects HTTP to HTTPS based on settings like SECURE_HSTS_SECONDS and SECURE_SSL_REDIRECT.

Question 4

Which setting must be set to use a custom user model in Django?

Accepted Answer

AUTH_USER_MODEL

Answer

AUTH_USER_MODEL = 'myapp.CustomUser' must be set before the first migration to tell Django which model to use for authentication.

Question 5

What does Django's `check_password(raw_password, encoded)` function do?

Accepted Answer

Verifies a plaintext password against a stored hashed password

Answer

check_password() hashes the raw password using the same algorithm identified in the encoded hash and compares them securely using a constant-time comparison.

Django Practice Test

Django Practice Test

Django Django Authentication & Security 2