A Flask view and a Django view both parse HTTP only after something has already accepted the socket. If that something is the application server itself, injection payloads, traversal paths, and credential-stuffing bursts land in Python before any policy can see them. The practical question is not which decorator to import. It is whether a reverse-proxy firewall sits on the only path clients can use.

Decide the path before you touch application code

SafeLine is documented as a self-hosted web application firewall that filters and monitors HTTP traffic between a web application and the internet. Deployed in front of the app, it is a reverse proxy: clients pass through it, and only then reach the origin ( https://docs.waf.chaitin.com/en/home ). The application guide states the same flow in operational terms.…