Plugins only protect post methods

1

Questions: Why kong only protects the POST method of a route and not the GET method?

Background:
The kong setup runs in a kubernetes cluster with konga as GUI.
So the chain is: www --> nginx ingress controller --> kong --> python flask microservice

I created a kong service related to the python flask microservice and then a route to the kong service.
Then i enabled a basic auth plugin on the route. This is the python code, but i think it should have nothing to do with the protection of the route:

class Upload(Resource):
    def post(self):
        parse = reqparse.RequestParser()
        parse.add_argument('file', type=werkzeug.datastructures.FileStorage, location='files')
        args = parse.parse_args()
        infile = args['file']
        uniqueID = uuid.uuid4()
        filename="{}.pdf".format(uniqueID)
        originalDir="original"
        if not os.path.exists(originalDir):
            os.makedirs(originalDir)
        originalFile=originalDir+"/"+filename
        infile.save(originalFile)

        return {
                'data': '',
                'message': "File {} uploaded and processed".format(filename),
                'status': 'success'
                }

    def get(self):
        parsetwo = reqparse.RequestParser()
        parsetwo.add_argument('filename', type=str)
        args = parsetwo.parse_args()
        filename = args['filename']
        getfile(filename, "yolo", "yolo")
        uploaddir=os.getcwd()
        return send_from_directory(directory=uploaddir+"/"+originalDir, filename=filename)


api.add_resource(Upload,'/api/v1.0/predict')

Yes and as i wrote, if i execute the CURL command to POST a file, then the user credentials are requested. And if i CURL with GET to the /api/v1.0/predict endpoint i have access without any credentials …

Here are the kong admin settings:
Service:
{"next":null,"data":[{"host":"upload.yolo","created_at":1562318322,"connect_timeout":60000,"id":"16c05394-a02e-4ea2-b306-aa16f13d6c0f","protocol":"http","name":"upload","read_timeout":60000,"port":5000,"path":"\/","updated_at":1562318340,"retries":5,"write_timeout":60000,"tags":null}]}

Routes:
{"next":null,"data":[{"updated_at":1562328095,"created_at":1562318404,"strip_path":false,"snis":null,"hosts":[],"name":"upload","methods":[],"sources":null,"preserve_host":false,"regex_priority":0,"service":{"id":"16c05394-a02e-4ea2-b306-aa16f13d6c0f"},"paths":["\/api\/v1.0\/predict*"],"destinations":null,"id":"08c409be-be91-4df1-a0cd-85614e1ca913","protocols":["http","https"],"tags":null}]}

Plugin on the route:
{"next":null,"data":[{"created_at":1562329014,"config":{"hide_credentials":false,"anonymous":null},"id":"53f97e22-494e-451b-b670-3cf87a3fe813","service":null,"name":"basic-auth","protocols":["http","https"],"enabled":true,"run_on":"first","consumer":null,"route":{"id":"08c409be-be91-4df1-a0cd-85614e1ca913"},"tags":null}]}

Thanks for your help.Preformatted text