What Django is
Explain what Django isA Python web framework that ships with an admin, authentication and an ORM.
Asked in interviews
AskedWhat is Django and what are its key features?
Done 0/0
To review 0
Old way, still asked about
The usual way today
Newer, Django 4.2 or later
The model
- MVT splits an app into a model for the data, a view for one request's logic and a template for the page. The framework itself plays MVC's controller.
- A project holds the settings and root URLs. An app is one feature inside it, switched on in
INSTALLED_APPS. - Middleware wraps the view in layers. A request walks down the
MIDDLEWARElist, and the response walks back up. - A QuerySet is lazy. It runs no SQL until you use its rows, and then it caches them.
- Django blocks the common attacks by default. Most holes appear where code turns a default off, as with
|safe,@csrf_exemptor SQL built by string formatting.
Projects, apps & requests
how the pieces fit and what runs whenProjects and apps
Create a project, then an app
django-admin startproject mysitepython manage.py startapp blogRun the dev server
python manage.py runserverTipGive each app one purpose. A blog app shouldn't also handle billing.
Asked in interviews
AskedWhat are Django apps and how do they differ from projects?MVT and the request cycle
Return a page from a view
render(request, 'a.html', ctx)Every view must return an HttpResponse.Find where
request.user comes fromSession and authentication middleware set it.Say what happens on no match or an exceptionDjango calls an error view, such as the
404 page.TrapThe template is MVC's view. A Django view holds the logic.
URLs & views
route a request and answer itRoute URLs to views
Capture a value with a converter or a regex
path('a/<int:id>/', view)re_path(r'^(?P<y>[0-9]{4})/$', view)List the path converters
str, int, slug, uuid and path. Only path matches slashes.Send the rest of the URL to an app
include('blog.urls') Link to a named pattern
{% url 'list' %}reverse('list')Tipurls.py picks the view, and views.py holds the code.
TrapDjango uses the first match, so order matters. Matching ignores the domain and the query string.
Function views and class views
Branch on the verb in a function
if request.method == 'POST':Give each verb a method in a class
def post(self, request):ArticleView.as_view() Stop a refresh from posting twice
return redirect('done')TipUse a function for one-off logic and a class for a common pattern or shared code.
TrapA function that branches only on GET and POST returns nothing for other verbs. Add a branch or @require_.
Generic views and decorators
List objects in pages, or show one
ListViewpaginate_by = 10DetailViewCreate, edit or delete with a form
CreateViewUpdateViewDeleteViewRequire a login, on a function or a class
@login_requiredLoginRequiredMixin TipUse generic views for standard CRUD, not unusual logic.
TrapThe top decorator runs first, so put @login_required above the method check.
Models & migrations
define the data and change the schemaCommon field types
Store text, a flag or an email
CharField(max_length=200) BooleanField()EmailField()Store a time, set once on create
DateTimeField(auto_now_add=True) null=True or blank=True
TextField(blank=True) Make a text field optionalDateField(null=True, blank=True)Make a date or number optionalallowednot allowed
TrapOn a text field, null=True gives two values for no data, NULL and the empty string.
Link models and choose on_delete
Link many to one
models.ForeignKey Link one to one, to extend the user
models.OneToOneField Link many to many with a join table
models.ManyToManyField Delete the dependents too
models.CASCADEBlock the delete while dependents exist
models.PROTECTmodels.RESTRICTReset the link, which for
SET_NULL needs null=Truemodels.SET_NULLmodels.SET_DEFAULT Let the database apply the rule (6.1+)
models.DB_CASCADE TrapDB_CASCADE is faster because Django fetches no related rows, but it sends no delete signals.
Custom managers
Change the starting QuerySet in a
models.Managerdef get_queryset(self): TrapThe first manager you define becomes the default. Declare a plain objects first so it hides no rows.
Asked in interviews
AskedWhat are Django model managers and how do you create custom managers?Model inheritance
abstract = TrueShare fields such as timestampsclass Restaurant(Place):Query every child through its parentproxy = TrueChange only ordering, manager or methodshas its own tableno table
TrapMulti-table inheritance links two tables with a OneToOneField, so loading a child reads both.
Asked in interviews
AskedWhat are the model inheritance styles in Django?Migrations
Write migration files from model changes
python manage.py makemigrationsApply them
python manage.py migrateRoll back to an earlier one
python manage.py migrate blog 0006Print a migration's SQL first
python manage.py sqlmigrate blog 0007TrapA rollback works only if the migrations you undo are reversible.
Asked in interviews
AskedExplain Django migrations and their purpose.Migrate safely in production
Add a required column in steps. Old and new code overlap during a deploy, so it stays nullable until the backfill ends.
Drop a columnMake it nullable, stop using it, then drop it in a later release.
Backfill in batches, each a short transaction
atomic = FalseBuild an index and keep writes working (PostgreSQL)
AddIndexConcurrently TrapMySQL can't roll back a failed schema change, so you fix it by hand.
Asked in interviews
AskedHow do you run Django migrations safely in production?ORM queries & transactions
read and write data without extra queriesQuery with the ORM
Explain what the ORM doesIt maps classes to tables and objects to rows.
Get all rows, or the rows that match
Article.objects.all() .filter(live=True) Get exactly one object, at once
.get(pk=1)Get one object, or else
None or a 404.filter(pk=1).first() get_object_or_404(Article, pk=1)TipThe ORM gives one API across databases, parameters that block SQL injection, and migrations.
Trapget() raises DoesNotExist or Multiple, so use it on unique fields.
Lazy QuerySets
Make a QuerySet run its SQL
for a in qs:list(qs)bool(qs)Count rows, or test for one, without loading them
qs.count()qs.exists()TrapChaining another .filter() builds a new QuerySet, and that one queries again.
Asked in interviews
AskedExplain Django QuerySets and lazy evaluation.Complex filters and summaries
Filter with OR or NOT
Q(a=1) | Q(b=2)~Q(title='')Compare two fields, or decrement with no race condition
filter(stock__lt=F('min')) update(stock=F('stock') - 1)Get one summary as a dictionary, which ends the chain
aggregate(Avg('price'))Add a value to each object, then filter on it
annotate(n=Count('book')) filter(n__gt=5)TipIn one filter() call, Q arguments must come before keyword arguments.
TrapSeveral Count() calls across relations multiply rows and give wrong totals. Pass distinct=True.
Fix N+1 queries
TipN+1 means one query for the list, then one more per item that touches a related object.
Trapauthor. in the loop ignores the prefetch and queries again.
Asked in interviews
AskedExplainselect_related() and prefetch_related() in Django ORM.Transactions
Make queries succeed or fail together
with transaction.atomic(): Lock rows inside a transaction
select_for_update() Send email only after a commit
transaction.on_commit(fn) TipATOMIC_REQUESTS puts every view in a transaction, but it adds overhead.
TrapCatch database errors around an atomic block, not inside it, or Django may miss the broken transaction.
Asked in interviews
AskedHow do you manage database transactions in Django?Templates & forms
draw pages and check what users sendTemplates and inheritance
Print a value, change it, or loop
{{ article.title }}{{ text|lower }}{% for a in qs %}Explain auto-escapingIt turns
< into <, which blocks most cross-site scripting.Mark a part in the base, then extend it
{% block content %}{% extends 'base.html' %}Add to the parent's block instead of replacing it
{{ block.super }}Trap{% extends %} must be the child's first template tag.
Custom tags and filters
Register a filter, a simple tag or an inclusion tag
@register.filter @register.simple_tag @register.inclusion_tag TipLoad the module in a template with {% load custom_tags %}.
Traptemplatetags needs an __init__.py, and the dev server needs a restart.
Asked in interviews
AskedHow do you create and use custom template tags and filters?Forms and validation
Define fields by hand, or generate them from a model
forms.Formforms.ModelFormCheck the POST data and read clean values
form.is_valid()form.cleaned_data Check one field, then rules across fields
def clean_title(self): def clean(self):Tipis_valid() runs field checks, then clean_<field>(), then clean().
TrapList fields explicitly, or users can set fields they shouldn't.
Model validators
Attach a callable that raises
ValidationErrorvalidators=[is_even] TrapValidators don't run on save(). A ModelForm or full_clean() runs them.
Login, roles & sessions
who the user is and what they may doLog in and custom users
Check credentials, which gives
None if they failauthenticate(request, **creds)Save the user in the session, or log out
login(request, user)logout(request)Keep the built-in user fields and add yours
AbstractUserDefine every field yourself, plus a manager
AbstractBaseUser Log in with a unique email
USERNAME_FIELD = 'email'TipIn other code, use get_, never User.
TrapSet AUTH_USER_MODEL before the first migration. Changing it later is complex.
Permissions and roles
Add your own beside add, change, delete and view
('publish', 'Can publish')Put it in Meta.permissions .Check one in code, a function view or a class view
user.has_perm('blog.publish') @permission_required PermissionRequiredMixin Use a group as a role
group.permissions.add(perm) user.groups.add(group) TipPermissions are model-level. Per-object rules need a custom backend or a package.
TrapCheck permissions, not group names. has_perm() keeps working when you rename a role.
Sessions
Write session data
request.session['cart'] = cartBlock session fixationDjango makes a new session key on login.
Purge expired sessions regularly
python manage.py clearsessionsTipBy default the database keeps the data, and the cookie holds only a session ID. Cookie-based sessions put the data in the cookie, where the client can read it.
TrapDjango saves only when you assign or delete a key. Assign a changed list back.
Asked in interviews
AskedHow do sessions work in Django?Middleware, signals & admin
run code around requests and savesWrite middleware
class Timer: def __init__(self, get_response): self.get_response = get_response def __call__(self, request): # before the view res = self.get_response(request) # after the view return res
Stop before the viewReturn a response and skip
get_response.Use the older hooks, like
process_response() MiddlewareMixinTipAdd the class's dotted path to MIDDLEWARE.
TrapOnly a middleware listed below Authentication can read request.user.
Signals
Run code after a save
@receiver(post_save, sender=User)Decide when to use oneFor side effects in another app, not core logic.
TipConnect receivers in App. They run one at a time before send() returns.
TrapQueryset update() and bulk_create() send no save signals.
Asked in interviews
AskedWhat are Django signals and when should you use them?The admin and its actions
Create an admin login
python manage.py createsuperuserRegister a
ModelAdmin with columns, filters and searchlist_displaylist_filtersearch_fieldsAdd an action on selected rows
@admin.actionactions = ['publish']Trapqueryset. in an action skips each save() and the save signals.
REST APIs & tests
serve JSON, limit it and test itREST APIs and rate limits
Return a list as JSON in plain Django
JsonResponse(items, safe=False)Get full CRUD for a model in DRF
viewsets.ModelViewSet Generate serializer fields from a model, or declare them
ModelSerializerSerializerLimit a view per IP with
django-ratelimit, which gives 403@ratelimit(key='ip', rate='5/m')Limit a DRF API
AnonRateThrottle UserRateThrottle TipPlain Django suits a few simple endpoints. Django REST Framework (DRF) suits many, or outside clients.
TrapThe local-memory cache keeps one counter per process. Use a shared cache such as Redis.
Tests, fixtures and factories
Run the tests
python manage.py testTest with no database, rollback per test, or real transactions
SimpleTestCaseTestCaseTransactionTestCase Load static data files in a test
fixtures = ['blog.json']Build data in code with
factory_boyfactory.django.DjangoModelFactory TrapFixtures go stale when models change, and a test can depend on a pk=1 hidden in a file.
Caching, pools & tasks
make pages fast and move slow work outSpeed up pages and connections
Check a query's plan, then index the field
qs.explain()db_index=TrueLoad only the columns you need
only('title')defer('body')Keep each thread's connection open
'CONN_MAX_AGE': 600Pool per process on PostgreSQL (5.1+)
'OPTIONS': {'pool': True}Pool across all workersPut PgBouncer in front of the database.
TipMeasure first. Django Debug Toolbar shows each page's queries and their time.
TrapCONN_MAX_AGE must stay 0 when the built-in pool is on.
Cache at each level
Cache every page
UpdateCacheMiddleware FetchFromCacheMiddleware Cache one view, or part of a template
@cache_page(60 * 15){% cache 500 sidebar %}Cache any value for 30 seconds
cache.set('k', v, 30)cache.get('k')TrapPages that differ per user need the right Vary headers, or users may get each other's pages.
Asked in interviews
AskedExplain Django's caching framework.Background tasks
Move slow work out of the requestThe view enqueues a job, and a worker runs it, usually Celery.
Use Django's Tasks framework (6.0+)
from django.tasks import taskIt only enqueues. Production needs a real worker.TipPass IDs, not model objects, and enqueue from on_commit().
TrapA retry can run a task again, so make tasks idempotent, meaning safe to run twice.
Asked in interviews
AskedHow do you run background tasks in Django?Security & deployment
what to set and check before releaseCSRF and common holes
Send the token from a form, or with AJAX
{% csrf_token %}X-CSRFTokenExplain the checkThe form's secret must match the cookie's, or Django returns
403.Pass values safely in raw SQL
Article.objects.raw(sql, [value])Add a second XSS layer (6.0+)Turn on the built-in Content Security Policy.
TrapDjango skips the CSRF check on safe methods such as GET, so a GET view must never change data.
Production settings
Turn off debug, list your domains, and hide the secret key
DEBUG = FalseALLOWED_HOSTS = ['example.com']os.environ['SECRET_KEY'] Force HTTPS and secure cookies
SECURE_SSL_REDIRECT = TrueSESSION_COOKIE_SECURE = TrueReport missing settings before a release
python manage.py check --deployTrapStart SECURE_ small. A wrong setting can break the site for as long as that value lasts.
Asked in interviews
AskedWhat are important Django settings for production deployment?Static and media files
Copy static files into
STATIC_ROOTpython manage.py collectstaticSet the storage backends (4.2+)
STORAGESIt replaced DEFAULT_FILE_STORAGE , removed in 5.1.TipThe web server or a CDN serves these files, never Django.
TrapUploads are untrusted. Limit their size, never execute them and serve them from a separate domain.
Asked in interviews
AskedHow do you handle static files and media files in Django production?WSGI and ASGI
Serve with sync worker processes (WSGI)
gunicorn mysite.wsgi:application Serve WebSockets and long polling (ASGI)
uvicorn mysite.asgi:application TrapAsync views under WSGI each get a one-off event loop and lose the benefit for long requests.
Asked in interviews
AskedExplain Django's deployment with WSGI and ASGI.Nothing matches. Try a shorter word, or clear the search.
Found this useful? Pass it on.
Pro · $10/mo
This sheet stays free. With Pro, you can:
- Every answer on this sheet. Read the full answer to all 56 questions it links, not just the 7 free ones.
- My sheet. The cards you star and the ones you miss in Quiz me, from every sheet, on one page to quiz and print.
- PDFs. Download this sheet and My sheet, laid out for A4, with every question a link to its answer.
- The rest of Pro. Every answer in the question library, and 1,000 AI credits a month.