security issue solved using external middleware

smash/smash/settings.py

@@ -36,6 +36,7 @@ INSTALLED_APPS = [
     'django_otp.plugins.otp_totp',
     'two_factor',
     'web',
+    'stronghold',
 
     'debug_toolbar'
 ]
@@ -50,6 +51,7 @@ MIDDLEWARE = [
     'django_otp.middleware.OTPMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
+    'stronghold.middleware.LoginRequiredMiddleware',
 ]
 
 ROOT_URLCONF = 'smash.urls'
@@ -119,9 +121,11 @@ STATIC_URL = '/static/'
 MEDIA_URL = '/media/'
 
 # Used for @login_required ecosystem
-# LOGIN_URL = '/login'
 LOGIN_URL = 'two_factor:login'
 LOGIN_REDIRECT_URL = 'web.views.appointments'
 LOGOUT_REDIRECT_URL = 'web.views.appointments'
 
+# Used for LoginRequiredMiddleware
+STRONGHOLD_PUBLIC_NAMED_URLS = (LOGIN_URL,)
+
 from local_settings import *