0

I have a live spring web app running on amazon and I have recently found login attacks from various IPs. So far nothing has been compromised as the login system is secure enough, with complex passowrds, and encoding with salt etc.. However, I would like to prevent this.

One thing that the logs revealed was that the attackers are somehow able to reach my service classes (only the authenticaltion manager) circumventing my login page. I dont have a special url for login, but how is it possible to call the authentication manager/service etc without going via the login jsp ? I can see logging from loadUserByUsername() method of my authentication service class (which implements UserDetailsService). Any help will be much appreciated.

1 Answer 1

2

Why do you need login.jsp, you can simulate a person posting the login form just by performing HTTP post with all the parameters right?

If all the request coming from the same IP, you can configure your firewall to block it. Other mechanism is to put a delay after a number of failures (eg 30min delay after 5 subsequent failures).

If you want to go further, two form authentication will increase security, eg perform sms confirmation if user is logging in from unknown IP / computer

1
  • Thanks, I found the answer to how they are login. By doing http post as you said , something like curl --data "j_username=xxx&j_password=yyy" http://www.mysecureurl.com/j_spring_security_check . Will be asking a followup question in a new thread.
    – Supra
    May 30, 2013 at 6:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.