title: Protect a GET and POST endpoint?
body: <p>I'm trying to protect a GET and a POST endpoint on my backend. The user is not logged in, but I want to prevent ppl from accessing the API endpoint unless they're using my app.</p>
  
  <p>I'm using React and axios to make the request, with Django and Python accepting the request. I'm trying to use a CSRF decorator:</p>
  
  <pre><code>class ClassView(View):
  
     @method_decorator(csrf_protect)
     def get(self, request):
        # Protected endpoint.
  
     @method_decorator(csrf_protect)
     def post(self, request):
        # Protected endpoint.
  </code></pre>
  
  <p>This doesn't work because I can still go directly to the API endpoint and make requests. I've also tried <code>@requires_csrf_token</code> and <code>@csrf_protect</code> without success.</p>