Django interview questions and answers

Enforce access in the view layer (LoginRequiredMixin, permission_required, DRF permissions) so APIs cannot be bypassed.

Unsafe methods need a CSRF token in a header or form field

only() loads a subset of columns

QuerySet caching keeps the whole result in memory after evaluation.

Inside atomic(), select_for_update() takes a row lock so concurrent transactions wait before modifying the same rows.

bulk_create issues INSERT in batches and does not call save() per row, so pre_save/post_save do not run.

Put reusable filters on a custom QuerySet and bind it with as_manager() so you can chain MyModel.objects.published().recent().

annotate() adds per-row annotations and may group by the primary key plus selected fields

Async middleware awaits get_response and must not call blocking ORM without sync_to_async.

StreamingHttpResponse content is an iterator consumed later

AuthenticationMiddleware already sets request.user lazily via SimpleLazyObject.

post_save can fire inside an uncommitted transaction that later rolls back, leaving Celery tasks or emails referring to rows that never existed.

Every save() may fan out to many receivers, including ones in third-party apps you forgot about.

It fires with actions such as pre_add, post_add, pre_remove, and post_clear, and pk_set may be None on clear.

Throttle classes implement allow_request and wait, typically using a cache key of user id or IP plus a rate such as 100/hour.

Subclass BaseAuthentication and implement authenticate(self, request) returning (user, auth) or None.

to_internal_value runs field-level to_internal_value, then field validators, then validate_<field>, then serializer.validate.

Override create/update and wrap related saves in transaction.atomic().

Hyperlinked identities are nice for HATEOAS clients but couple payloads to URL reversing and request context.

They inspect view serializers, pagination, and authentication to emit OpenAPI.