Django back + react front 403 forbidden on logout function although changed permissions to AllowAny

Trying to do a simple web service using django rest api + react. I'm using CORS and absolute path when fetching API. Also i'm using session auth. Everything works fine except my logout function. That's how it looks django views.py:

`from rest_framework.request import Request
from rest_framework.response import Response
from rest_framework.decorators import api_view, permission_classes, authentication_classes
from rest_framework.permissions import IsAuthenticated, AllowAny
from rest_framework.authentication import SessionAuthentication
from core.serializers import UserSerializer, LoginRequestSerializer, iPadSerializer
from core.models import iPad
from rest_framework import status, viewsets, generics
from django.http import JsonResponse
from django.contrib.auth import authenticate, login, logout

@api_view(['POST'])
@permission_classes([AllowAny])
def logout_view(request):
    logout(request)
    return Response(status=status.HTTP_200_OK)`

And that's how my react handleLogout looks:

const handleLogout = () => {
        setLoading(true);
        fetch('http://localhost:8000/api/logout', {
            credentials: 'include',
            method: 'POST',
            headers: {
                'Content-Type': 'application/json;charset=utf-8',
                'X-CSRFToken': csrftoken,
            },
        })
            .then((response) => {
                if (response.ok) {
                    setIsLoggedIn(false);
                    setError(null);
                } else {
                    throw Error(`Something went wrong: code ${response.status}`);
                }
            })
            .catch((error) => {
                console.log(error);
                setError('Ошибка при выходе');
            })
            .finally(() => setLoading(false));
    };

I thought that problem is my CORS settings, bul strangely every other fetch works fine. That's my CORS settings and it's still don't work:

CORS_ALLOW_CREDENTIALS = True

CORS_ALLOWED_ORIGINS = [
    'http://localhost:3000',
    'http://127.0.0.1:3000',
]

CORS_ALLOW_METHODS = [
    "DELETE",
    "GET",
    "OPTIONS",
    "PATCH",
    "POST",
    "PUT",
]
CORS_ALLOW_HEADERS = [
    "accept",
    "accept-encoding",
    "authorization",
    "content-type",
    "dnt",
    "origin",
    "user-agent",
    "x-csrftoken",
    "x-requested-with",
]

I have handleLogin which works exactly the same on react side and it works flawlessly. Also if i change my proxy to 127.0.0.1:8000 and stop using absolute urls (/api/logout instead of http:...) it works just fine, so i still think that problem is my CORS.Sry for my poor english <3

When you log out the http_method_name in the @api_view decorator is ['GET']

change :

@api_view(['POST'])

to :

@api_view(["GET"])

and in the logout_view function, you have to delete the Token for the user so he will no longer be authenticated . something like : request.user.auth_token.delete()