I have a live spring web app running on amazon and I have recently found login attacks from various IPs. So far nothing has been compromised as the login system is secure enough, with complex passowrds, and encoding with salt etc.. However, I would like to prevent this.
One thing that the logs revealed was that the attackers are somehow able to reach my service classes (only the authenticaltion manager) circumventing my login page. I dont have a special url for login, but how is it possible to call the authentication manager/service etc without going via the login jsp ? I can see logging from loadUserByUsername() method of my authentication service class (which implements UserDetailsService). Any help will be much appreciated.