REST Service within a Web Application

Question

I have a web application with Spring MVC and there is a need for a client to consume a service, so I created in the same project a resource mapped with Restcontroller, when testing the service using as a client Postman came across a problem, as response came the html of the login page and not the data as json.

In Postman I configured the Authorization of type Basic informed user and password I thought that with this would be all ok

It would not be possible to have a Rest resource in the same application?

or would have to make some specific security configuration?

Updated at 01/02/2019

I spent the day yesterday studying about Spring Security and understood that yes I can create an authentication configuration for my API and when not the other one through the login form. My configuration class however is not yet ok, I have configured two instances of Websecurityconfigureradapter more still not rolling in Postman I get the html of the login form.

@EnableWebSecurity
@ComponentScan(basePackageClasses = AppUserDetailsService.class)
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true, 
proxyTargetClass = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    //@Autowired
    //private RestAuthenticationEntryPoint authenticationEntryPoint;    
    @Bean
    public static PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Configuration
    @Order(2)
    public static class AppWebConfigurationAdapter extends WebSecurityConfigurerAdapter {

        @Autowired
        private UserDetailsService userDetailsService;      

        @Override
        public void configure(WebSecurity web) throws Exception {
            web.ignoring()
             .antMatchers("/resources/**");
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(userDetailsService)
              .passwordEncoder(passwordEncoder());
        }   

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests()
               .antMatchers("/images/**", "/javascripts/**", "/layout/**", "/stylesheets/**", "/h2-console/**").permitAll()
                 .anyRequest().authenticated()
                 .and()
               .formLogin()
                  .loginPage("/login").permitAll()
                  .and()
                .logout()
                   .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                   .and()
                .exceptionHandling()
                .accessDeniedPage("/403")
                .and()
                .sessionManagement()
                .invalidSessionUrl("/login");
            }   

    }

    @Configuration
    @Order(1)
    public static class ApiWebConfigurationAdapter extends WebSecurityConfigurerAdapter {

        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth.inMemoryAuthentication()
            .withUser("admin")
            .password("admin").roles("ADMIN");
        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                .antMatcher("/api/**")
                .authorizeRequests()
                .anyRequest().hasRole("ADMIN")
            .and()
                .httpBasic()
                .and()
                .csrf().disable();        
        }

        @Bean
        public AuthenticationEntryPoint authenticationEntryPoint(){
            BasicAuthenticationEntryPoint entryPoint = new  BasicAuthenticationEntryPoint();
            entryPoint.setRealmName("admin realm");
            return entryPoint;
        }
    }

Here’s the code for one of the resources I’m exposing

@RestController
@RequestMapping(value = "/api/produtos")
public class ProdutosResources {

    @Autowired
    private ProdutoService service;

    @GetMapping
    public ResponseEntity<List<Produto>> listar(){

        return ResponseEntity.status(HttpStatus.OK).
                body(service.findAll());
    }

    @GetMapping("/{id}")
    public ResponseEntity<?> buscarPorId(@PathVariable Long id){

        Optional<Produto> entidade = service.findById(id);

        return ResponseEntity.status(HttpStatus.OK).body(entidade);
   }    
}