profiles

profiles/views.py

@@ -70,6 +70,8 @@ class BlocksView(APIView):
 		return Response("Deleted", status=status.HTTP_200_OK)
 
 class FriendsView(APIView):
+	permission_classes = (permissions.IsAuthenticated,)
+	authentication_classes = (SessionAuthentication,)
 
 	def get(self, request):
 		friends = FriendModel().getFriends(request.user.pk)