Django defaults help—CSRF middleware, SQL injection resistance via ORM, template auto-escaping—but security still requires correct configuration and discipline.
Built-in protections
- CSRF — token on POST forms
- XSS — auto-escape in templates; beware
|safeand mark_safe - SQL injection — use ORM or parameterized queries—never string-concat SQL with user input
- Clickjacking — XFrameOptionsMiddleware
Your responsibilities
- Keep Django and dependencies updated
- Validate and permission-check every view
- Secure cookies, HTTPS, strong password hashers
- Do not expose DEBUG tracebacks or admin on public URLs without IP allowlists
Important interview questions and answers
- Q: Is Django ORM always safe from SQL injection?
A: ORM parameterizes queries; raw SQL with f-strings from user input is dangerous. - Q: When is |safe dangerous?
A: When content includes user-supplied HTML—use bleaching or avoid raw HTML. - Q: Mass assignment?
A: ModelForm fields/exclude and serializer fields whitelist what clients can set—never bind all model fields blindly.
Self-check
- How does CSRF protection work?
- Why whitelist form/serializer fields?
Interview prep
- Is ORM always SQL-injection safe?
ORM queries are parameterized; raw SQL built with f-strings from user input is still vulnerable.