Django interview questions with answer outlines

Fifteen common Django interview questions

1. Explain Django's MVT architecture.
2. Walk me through the request–response cycle.
3. What is middleware? Give examples.
4. How do Django querysets evaluate lazily?
5. select_related versus prefetch_related?
6. How do you find and fix N+1 queries?
7. How do migrations work, and how do you handle conflicts?
8. What are signals, and when should you avoid them?
9. Function-based versus class-based views?
10. How does Django authentication work? Custom user models?
11. How do you implement permissions?
12. What caching options does Django provide?
13. How does Django protect against CSRF, XSS and SQL injection?
14. What does Django REST Framework add? Serializers and viewsets?
15. How does Django support async?

Architecture and request cycle

Models define data and business rules; views handle requests and return responses; templates render presentation — Django's take on MVC, with the framework acting as controller through URL routing. A request passes through middleware (security, sessions, authentication, CSRF), is routed by URLconf to a view, which uses models and templates or serializers, and the response passes back through middleware in reverse order.

ORM and performance

N+1 queries appear when a loop accesses a related object for each row — book.author in a list of books. Detect them with a debug toolbar or query logging in tests, and fix with select_related or prefetch_related. Add database indexes for frequently filtered fields with Meta.indexes.

Migrations, signals and views

• Migrations are versioned schema changes generated from model changes; resolve conflicts with a merge migration, and separate schema from data migrations for large tables.
• Signals decouple side effects, but hidden control flow makes them hard to debug; explicit service functions are often clearer.
• Class-based views offer reuse through generic views and mixins; function-based views are explicit and simple for one-off logic.

Auth, security and caching

Start projects with a custom user model, because changing it later is painful. Use the permission system and decorators or mixins for access control, and object-level permissions where needed. Django protects against CSRF with tokens, XSS with template auto-escaping, SQL injection with parameterised ORM queries and clickjacking with frame headers — protections you weaken by using raw SQL carelessly or marking strings safe. Caching works at per-site, per-view, template-fragment or low-level levels with Redis or Memcached backends.

APIs and async

Django REST Framework adds serializers for validation and conversion, viewsets and routers for CRUD endpoints, authentication classes, permissions, throttling and pagination. Django supports async views and an ASGI server for I/O-heavy endpoints, though parts of the ORM still run synchronously through adapters, so async helps most for calling external services. See Python interview questions and REST API interview questions.

Deploying Django

Production questions come up for backend roles: run Django under a WSGI or ASGI server behind a reverse proxy, serve static files from a CDN or object storage, keep settings in environment variables, set DEBUG off and configure allowed hosts, run migrations as a deliberate deployment step, use a task queue for background work, and monitor errors and slow queries. Mentioning these shows you've run Django beyond a development server.

Practising

Interviewers follow up on the most specific thing you say, so rehearse the second question as well as the first. CoPilot Interview, a free AI interview assistant, runs Django mock interviews with follow-ups and produces a report of likely next-round questions. Take a list view with an N+1 problem, fix it, and explain the query count before and after.

Disclosure: CoPilot Interview is our product, so weigh what we say about it accordingly. Everything else on this page applies whichever tool you use, or none.

Frequently asked questions

What are common Django interview questions?

MVT architecture, the request cycle, middleware, lazy querysets, select_related versus prefetch_related, N+1 queries, migrations, signals, views, authentication, permissions, caching, security protections, Django REST Framework and async.

What is the difference between select_related and prefetch_related?

select_related uses a SQL join to fetch foreign key and one-to-one relations in one query; prefetch_related runs a separate query for many-to-many or reverse relations and joins in Python.

How does Django prevent CSRF attacks?

Its CSRF middleware requires a secret token in unsafe requests such as POST, which forged cross-site requests can't supply.

Should I use a custom user model in Django?

Yes, at the start of a project. It makes future changes to user fields possible without a difficult migration.