auth_basic issue, won't protect full directory

Hello,

I notice a big bug (or is it me) using nginx/1.16.1 (on Arch) and auth_basic which don't protect the whole directory using a simple

location /admin {
auth_basic "Restricted";
auth_basic_user_file /srv/http/admin/.htpasswd;
}

When i go to admin/index.php i got a auth request. But, if i have a admin/test.php file, i can request the file without any auth request.

What am i doing wrong ?
Bye