Prevent internal POST methods to be called by third parties
Not only django but this behavior is common in all others,
You can only apply 2 solution,

Apply CORS and just allow your domain, to block other domain to access data from your API response, but this will not effective if a user direct call your API end-point.
As lain said in comment, If data is sensitive or user's personal, add authentication in API. 

Thanks
I'm worried about the security of my web app, I'm using Django and sometimes I use AJAX to call a Django url that will execute code and then return an HttpResponse with a message according the result, the user never notice this as it's happening in background.
However, if the url I'm calling with AJAX is, for example, "runcode/", and the user somehow track this and try to send a request to my domain with that url (something like "www.example.com/runcode/"), it will not run the code as Django expects the csrf token to be send too, so here goes the question.
It is possible that the user can obtain the csrf token and send the POST?, I feel the answer for that will be "yes", so anyone can help me with a hint on how to deny these calls if they are made without the intended objective?