Django Interview Questions & Answers (2026)

What is the difference between function‑based views and class‑based views in Django?

Function‑based views (FBVs) are simple Python functions that receive a request and return a response, offering explicit control flow. Class‑based views (CBVs) encapsulate common patterns (list, detail, create) into reusable classes, allowing inheritance and mixins for DRY code. Interviewers expect you to mention that CBVs reduce boilerplate but can be harder to debug, while FBVs are straightforward for custom logic. A strong candidate cites when to choose each based on project complexity and maintainability.

def my_view(request):
    return HttpResponse('Hello')

class MyView(View):
    def get(self, request):
        return HttpResponse('Hello')

How does Django's ORM prevent SQL injection attacks?

Django's ORM builds queries using parameterized statements; user input is never concatenated into raw SQL strings. The ORM sends placeholders to the database driver, which safely escapes values. Interviewers look for awareness that this protection applies only when using the ORM API—not when executing raw SQL via cursor.execute without parameters. A strong answer also notes that proper use of QuerySet filters and avoiding .raw() unless necessary further mitigates injection risk.

Explain the purpose of middleware in Django and give an example of a custom middleware you might write.

Middleware is a lightweight, per‑request hook that processes request and response objects globally. It can modify headers, enforce authentication, or log metrics. For example, a custom middleware could record request latency: on process_request store start time, on process_response compute elapsed time and log it. Interviewers expect you to describe the two‑method pattern (process_request/process_response) and how ordering in MIDDLEWARE affects execution flow.

class TimingMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response
    def __call__(self, request):
        start = time.time()
        response = self.get_response(request)
        elapsed = time.time() - start
        logger.info(f"{request.path} took {elapsed}s")
        return response

What is the role of the 'manage.py' script in a Django project?

manage.py is a thin wrapper around django-admin that sets the DJANGO_SETTINGS_MODULE environment variable for the project, allowing you to run commands like migrate, runserver, and createsuperuser. It ensures the correct settings are loaded and provides a convenient entry point for development and deployment scripts. Interviewers want you to stress that it abstracts configuration and enables reproducible management tasks across environments.

How does Django handle static files versus media files?

Static files (CSS, JS, images) are assets that don’t change per user and are served via STATIC_URL and collected with collectstatic. Media files are user‑uploaded content stored under MEDIA_ROOT and accessed via MEDIA_URL. In production, static files are usually served by a CDN or web server, while media files may be stored on cloud storage. Interviewers expect you to discuss settings, the difference between collectstatic and upload handling, and security considerations for media access.

Describe how Django's request/response cycle works, from URL resolution to response rendering.

When a request arrives, Django consults the URLconf to match the path to a view. It then constructs a HttpRequest object, passes it through middleware (process_request), invokes the view (function or class), which may query the ORM, render a template, or return JSON. The response traverses middleware (process_response) before being sent back. Interviewers look for clarity on URLResolver, view dispatch, middleware order, and how TemplateResponse can defer rendering until after middleware processing.

What are Django signals and when would you use them?

Signals are a publish‑subscribe mechanism that lets decoupled components react to events like model.save() or request_finished. You define a receiver function and connect it to a signal (e.g., post_save). Use cases include automatically creating related objects, clearing caches, or sending notifications without cluttering model logic. Interviewers expect you to mention the trade‑off of hidden side effects and the importance of keeping receivers lightweight.

from django.db.models.signals import post_save
from django.dispatch import receiver

@receiver(post_save, sender=User)
def create_profile(sender, instance, created, **kwargs):
    if created:
        Profile.objects.create(user=instance)

How can you optimize a Django queryset to reduce database hits?

Use select_related for foreign‑key relationships and prefetch_related for many‑to‑many or reverse foreign keys, which batch queries. Also, limit fields with only() or values(), and avoid N+1 problems by inspecting query count with Django Debug Toolbar. Interviewers want you to explain the difference between the two methods, when each is appropriate, and how they impact memory versus query count.

Explain the purpose of the 'django.contrib.sessions' framework and how session data is stored by default.

The sessions framework provides a way to store per‑user data across requests. By default, Django uses signed cookies (CookieSession) if SESSION_ENGINE is not overridden, but the common default is database‑backed sessions (django.contrib.sessions.backends.db) storing data in the django_session table. Interviewers look for knowledge of alternative backends (cached, cached_db, file) and the security implications of each.

What is the difference between 'django.forms' and 'django.forms.ModelForm'?

django.forms.Form defines fields manually and is useful for arbitrary input, while ModelForm automatically generates fields based on a model's fields, handling validation and saving instances. ModelForm reduces boilerplate for CRUD forms but ties the form to the model schema. Interviewers expect you to discuss when to use each, custom validation via clean_<field>, and how ModelForm.save(commit=False) enables extra processing.

How does Django's caching framework work and what are common cache backends?

Django provides a high‑level cache API (cache.set, cache.get) that abstracts storage details. Common backends include in‑memory LocMemCache, Memcached, and Redis. You configure CACHE_BACKEND in settings, then can cache per‑view with @cache_page or low‑level cache fragments. Interviewers look for understanding of cache key design, expiration, and the trade‑off between speed (in‑process) and shared state (distributed caches).

What are the security features Django provides out of the box?

Django includes CSRF protection via middleware and {% csrf_token %}, XSS escaping in templates, clickjacking defense with X-Frame-Options header, secure password hashing (PBKDF2, Argon2), and HTTPS settings (SECURE_SSL_REDIRECT, SESSION_COOKIE_SECURE). Interviewers expect you to mention enabling these defaults, customizing settings for production, and the importance of keeping SECRET_KEY secret.

Describe how Django Rest Framework (DRF) serializes data and handles validation.

DRF serializers map model instances or arbitrary data to Python primitives, then to JSON. They define fields, validation rules, and create/update methods. Validation runs field‑level (validate_<field>) and object‑level (validate) methods, raising serializers.ValidationError with detailed messages. Interviewers want you to explain how serializers decouple representation from models, support nested serialization, and can be used for both input and output, improving API consistency.

class ArticleSerializer(serializers.ModelSerializer):
    class Meta:
        model = Article
        fields = ['id', 'title', 'content']

How would you implement role‑based access control (RBAC) in a Django project?

Use Django's built‑in auth groups and permissions, assigning users to groups that represent roles. Create custom permissions on models, then enforce them via the @permission_required decorator or DRF's permission_classes (IsAuthenticated, DjangoModelPermissions). For fine‑grained control, write a custom permission class that checks user.role against request.method and object attributes. Interviewers look for a layered approach: database permissions, view decorators, and optional middleware for global checks.

Explain the use of 'select_for_update' in Django and when it is appropriate.

select_for_update acquires a row‑level lock on the selected rows within a transaction, preventing other transactions from modifying them until the lock is released. It is appropriate for scenarios like inventory deduction, financial transfers, or any critical section where race conditions could corrupt data. Interviewers expect you to discuss the need for atomic blocks, potential deadlocks, and database support (PostgreSQL, MySQL InnoDB).

What is the purpose of the 'django.contrib.contenttypes' framework?

ContentTypes provides a generic way to refer to any model class via a ContentType object, enabling generic relations (GenericForeignKey) and permissions that span multiple models. It underpins the admin's permission system and allows you to build polymorphic models without inheritance. Interviewers want you to explain how it stores app_label and model name, and the performance considerations of using generic relations versus explicit foreign keys.

How can you safely run background tasks in a Django application?

Integrate a task queue like Celery or Django‑RQ, which offloads work to worker processes. Define tasks as regular Python functions, decorate with @shared_task, and configure a broker (RabbitMQ, Redis). Ensure idempotency, handle retries, and store results if needed. Interviewers expect you to discuss why threading or cron is insufficient for scalability, and how to monitor tasks with Flower or the Django admin.

What are the pros and cons of using Django's built‑in admin for internal tools?

Pros: rapid development, auto‑generated CRUD UI, permission integration, and extensibility via ModelAdmin. Cons: limited UI customization, performance overhead for large datasets, and potential security exposure if not hardened. Interviewers want you to mention customizing list_display, adding search fields, and the need to disable admin in production for non‑trusted users, balancing speed of delivery against maintainability.

Explain how Django's migration system works and how you would handle a migration conflict.

Migrations are Python files describing schema changes; Django tracks applied migrations in the django_migrations table. When two branches add migrations with the same dependency, a conflict occurs. Resolve by merging branches, creating a new migration that depends on both conflicting ones (using --merge), and ensuring the operations are compatible. Interviewers expect you to discuss makemigrations, migrate, and the importance of testing migrations on a fresh database.

How does Django support internationalization (i18n) and localization (l10n)?

Django provides translation utilities: mark strings with gettext_lazy, compile .po files, and use {% trans %} in templates. LocaleMiddleware selects the appropriate language based on request headers or user preference. Date, number, and timezone formatting adapt via format localization. Interviewers look for awareness of lazy translation to avoid early evaluation, the role of LOCALE_PATHS, and how to switch languages programmatically.