Django interview questions and answers

GenericAPIView plus mixins gives you get/post handlers and queryset/serializer_class.

DefaultRouter and SimpleRouter bind viewset actions to URL patterns including optional trailing slashes.

Authentication identifies the user (who is calling) and sets request.user and request.auth.

Pagination classes split list querysets into pages and add next/previous metadata.

Nest a serializer as a field, or use depth on ModelSerializer for read-only trees.

Enforce access in the view layer (LoginRequiredMixin, permission_required, DRF permissions) so APIs cannot be bypassed.

Unsafe methods need a CSRF token in a header or form field

only() loads a subset of columns

QuerySet caching keeps the whole result in memory after evaluation.

Inside atomic(), select_for_update() takes a row lock so concurrent transactions wait before modifying the same rows.

bulk_create issues INSERT in batches and does not call save() per row, so pre_save/post_save do not run.

Put reusable filters on a custom QuerySet and bind it with as_manager() so you can chain MyModel.objects.published().recent().

annotate() adds per-row annotations and may group by the primary key plus selected fields

Async middleware awaits get_response and must not call blocking ORM without sync_to_async.

StreamingHttpResponse content is an iterator consumed later

AuthenticationMiddleware already sets request.user lazily via SimpleLazyObject.

post_save can fire inside an uncommitted transaction that later rolls back, leaving Celery tasks or emails referring to rows that never existed.

Every save() may fan out to many receivers, including ones in third-party apps you forgot about.

It fires with actions such as pre_add, post_add, pre_remove, and post_clear, and pk_set may be None on clear.

Throttle classes implement allow_request and wait, typically using a cache key of user id or IP plus a rate such as 100/hour.