How to make a ban on entering by url, if it was not made by the item "name"

I have a small function that controls the checkbox. When the user clicks on the checkbox, this link is triggered by {% url 'done' task.pk %}. But if you try to open this link in another tab, the checkbox also switches.<br>
How to make the user be able to follow the link by the value "name", but when he manually enters the url, there would be an error. Well, or some alternative solution to this problem.<br>

<b>Code</b>
template

<div class="is__done__checkbox">
    <form method="post" action="{% url 'done' task.pk %}">
    {% csrf_token %}
    <input type="checkbox" name="is_done" onchange="this.form.submit()" {% if task.is_done %} checked {% endif %}>
    </form>
</div>

url

path('profile/<int:pk>/done/', done, name='done'),

view

def done(request, pk):
    task = Tasks.objects.get(pk=pk)
    is_done = request.POST.get('is_done', False)
    if is_done == 'on':
        is_done = True

    task.is_done = is_done
    task.save()
    return redirect(request.META.get('HTTP_REFERER'))

I tried it

def login_excluded(redirect_to):
    def _method_wrapper(view_method):
        def _arguments_wrapper(request, *args, **kwargs):
            if request.user:
                return HttpResponse(status=404)
            return view_method(request, *args, **kwargs)
        return _arguments_wrapper
    return _method_wrapper

@login_excluded('/profile/<int:pk>/done/')
def done(request, pk):
    task = Tasks.objects.get(pk=pk)
    is_done = request.POST.get('is_done', False)
    if is_done == 'on':
        is_done = True

    task.is_done = is_done
    task.save()
    return redirect(request.META.get('HTTP_REFERER'))

But when clicking on the checkbox and for the user there was an error

> But if you try to open this link in another tab, the checkbox also switches.

Your view does not prevent accessing it through a GET request. You can use the @require_POST decorator&nbsp;^[Django-doc]:

<pre><code>from django.views.decorators.http import <b>require_POST</b>

@login_excluded('/profile/&lt;int:pk&gt;/done/')
<b>@require_POST</b>
def done(request, pk):
task = Tasks.objects.get(pk=pk)
task.is_done = request.POST.get('is_done', False) == 'on'
task.save()
return redirect(request.META.get('HTTP_REFERER'))</code></pre>

> Note: It is often better to use <code>get_object_or_404(&hellip;)</code>&nbsp;^[Django-doc],
> then to use <code>.get(&hellip;)</code>&nbsp;^[Django-doc] directly. In case the object does not exists,
> for example because the user altered the URL themselves, the <code>get_object_or_404(&hellip;)</code> will result in returning a HTTP 404 Not Found response, whereas using
> <code>.get(&hellip;)</code> will result in a HTTP 500 Server Error.

You could make it so that the user has to have submitted the value via the form:

def done(request, pk):
#check to see the page request is a submitted form
if request.method == "POST":
    task = Tasks.objects.get(pk=pk)
    is_done = request.POST.get('is_done', False)
    if is_done == 'on':
        is_done = True

    task.is_done = is_done
    task.save()
    return redirect(request.META.get('HTTP_REFERER'))
else:
    #If the user has just typed the URL (eg, method=="GET"), then do something else
    return redirect('/formerror')