Basic Auth asked on all endpoints when adding GraphiQL or Altair dependencies

I need to add a GraphQL endpoint to a Spring Boot application with an existing REST API that uses @RestController and such.

When I add any of the GraphQL tool as a dependency, such as altair-spring-boot-starter or graphiql-spring-boot-starter for example, and run the server, I am suddendly asked to provide a Basic Auth on all endpoints even though the base application does not require one.

diff of pom.xml

+               <dependency>
+                       <!-- GraphQL starter (adds core and servlet) -->
+                       <groupId>com.graphql-java-kickstart</groupId>
+                       <artifactId>graphql-spring-boot-starter</artifactId>
+                       <version>7.0.0</version>
+               </dependency>
+               <dependency>
+                       <!-- GraphQL Tool -->
+                       <groupId>com.graphql-java-kickstart</groupId>
+                       <artifactId>graphql-java-tools</artifactId>
+                       <version>6.0.0</version>
+               </dependency>
+               <dependency>
+                       <!-- GraphiQL interactive tool -->
+                       <groupId>com.graphql-java-kickstart</groupId>
+                       <artifactId>graphiql-spring-boot-starter</artifactId>
+                       <version>7.0.0</version>
+                       <scope>runtime</scope>
+               </dependency>

Two questions then:

• how should I embed the Altair/GraphiQL tools to my existing REST API ?
• how can I solve the suddenly appearing Basic Auth ?

Thanks

[GuillaumeDesforges]

Many thanks for the quick reply and clear indications, I will investigate with that in mind.

[oliemansm]

It doesn’t add any specific rules for security. It relies on your existing spring security configuration to take care of that. If you use Spring Security you probably have a WebSecurityConfigurerAdapter somewhere to finetune the security settings for your app. You should add /graphiql and possibly /graphl to it to exclude it from those security settings. If you don’t the default kicks in and everything is secure.