My heroku app is requesting a password that I did not put there

Question

I'm new to the process of sending an application to production and I'm using Heroku free plan to test. Today I went to check my app and the API I made using Spring boot is not working and is requesting a login that I didn't do. My app address is https://erik-financial-api.herokuapp.com and when you go there it redirects you to the address https://erik-financial-api.herokuapp.com/login with the following:

I did not make this page and none of the passwords (from my app or from my Heroku account) work on it. This was supposed to be just a REST API for another front-end app. Does anyone know why is this happening?

The code for this project can be found on my GitHub on https://github.com/esscheffer/financial-api

Edit: this seems to be a default spring security login page. I have searched for solutions, but none worked so far. What I have tried:

Add

override fun configure(security: HttpSecurity) {
    security.httpBasic().disable()
            .formLogin().disable()
}

to my WebSecurityConfigurerAdapter class.

Add http.httpBasic().disable().formLogin().disable() to the configure of my ResourceServerConfigurerAdapter class.

Add (exclude = [SecurityAutoConfiguration::class]) to the @SpringBootApplication sanitation on my application class.

The first 2 tries didn't remove the login page and the last one broke the app, returning 404 for all pages. Note that this only happens when I deploy my application to Heroku. When running locally I don't have this login page or any other problem.

score 1 · Answer 1 · answered Jun 13 '20 at 23:35

Add a new configuration class com.scheffer.erik.financial.api.config.SecurityConfig, where in the configure method you can disable the HTTP Basic authentication as well as login form based authentication, like below:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity security) throws Exception {
        security
                .httpBasic().disable()
                .formLogin().disable();
    }
}

score 0 · Answer 2 · answered Jun 12 '20 at 12:17

Do it like this...permit all requests for the home page...I hope it will work for you.

@Override
        protected void configure(HttpSecurity http) throws Exception {
            http.cors().and().csrf().disable().
                    authorizeRequests()

                    .antMatchers("/").permitAll()        //OR .antMatchers("/**").permitAll()

                    .anyRequest().authenticated();

        }

My heroku app is requesting a password that I did not put there

2 Answers2