required decorator does not take into account method

[FND]

I have a scenario where a route should only be protected by basic auth for certain methods:

@app.route("/items", methods=["GET"])
@basic_auth.required
def list_items():
    ...


@app.route("/items", methods=["POST"])
def create_item():
    ...

That's because POSTing requires a bearer token instead of basic auth:

> GET /items
> Authorization: Basic ...

> POST /items
> Authorization: Bearer ...

However, it seems the required decorator does not take into account the method, so with the code above, both handlers are basic auth-protected.

[mdavis-xyz]

Why does POSTing require a bearer token?

The Wikipedia page doesn't mention that:
https://en.wikipedia.org/wiki/Basic_access_authentication#Client_side