require POST for login_user

ARCH-1253
2019-12-10 21:53:13 -05:00
parent 9f72c69e8a
commit 3505492fff
2 changed files with 92 additions and 61 deletions
--- a/openedx/core/djangoapps/user_authn/views/login.py
+++ b/openedx/core/djangoapps/user_authn/views/login.py
@@ -333,6 +333,7 @@ def finish_auth(request):  # pylint: disable=unused-argument


@ensure_csrf_cookie
+@require_http_methods(['POST'])
 def login_user(request):
    """
    AJAX request to log in the user.