Merge pull request #22513 from edx/robrap/ARCH-1253-login-user-post-only-take-3

ARCH-1253: require POST for login_user
2019-12-15 15:59:00 -05:00
parent ca519d63f3 3505492fff
commit b2be6b3ba2
2 changed files with 92 additions and 61 deletions
--- a/openedx/core/djangoapps/user_authn/views/login.py
+++ b/openedx/core/djangoapps/user_authn/views/login.py
@@ -333,6 +333,7 @@ def finish_auth(request):  # pylint: disable=unused-argument


@ensure_csrf_cookie
+@require_http_methods(['POST'])
 def login_user(request):
    """
    AJAX request to log in the user.