Check how the project was started for the first time. A manual docker compose up does not configure the public port in nginx.
If the container published its port on 0.0.0.0, the browser may connect to the application directly. A password stored for nginx does not protect such a connection.
Stop the project and start it with the button in the panel. Then open the public address in a window with no saved credentials. It should ask for the password as configured.
.
