I think all POST, PUT, DELETE requests is CSRF protected by default in DRF, But I saw in some tutorial videos that they are using @method_decorator(csrf_protect) on some class-based views with POST and DELETE request, so I did it same.

But now I’m thinking what is the purpose of doing that when these request is CSRF protected by default?

@method_decorator(csrf_protect, name='dispatch')
class LogoutView(APIView):
    def post(self, request, format=None):
        try:
            auth.logout(request)
            return Response({'success': 'Logged out.'})
        except Exception as e:
            print(e)
        return Response({'error': 'Something went wrong.'})