Credential Stuffing in Spring Boot

Credential stuffing in Spring Boot applications typically exploits predictable authentication endpoints and weak rate limiting. Attackers leverage automated tools to test stolen username/password combinations across multiple services, exploiting the fact that users often reuse credentials across platforms.

In Spring Boot, credential stuffing often targets the standard authentication flow. Consider this common Spring Security configuration:

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable() // often disabled for APIs
            .formLogin()
                .loginPage("/login")
                .permitAll()
                .defaultSuccessUrl("/home")
                .and()
            .authorizeRequests()
                .antMatchers("/public/**").permitAll()
                .anyRequest().authenticated();
    }
}

The predictable /login endpoint and lack of rate limiting make this vulnerable. Attackers can script requests to this endpoint, cycling through credential lists. Spring Boot's default behavior allows unlimited authentication attempts, which is precisely what credential stuffing exploits.

Another Spring Boot-specific manifestation occurs in REST controllers handling authentication:

@RestController
@RequestMapping("/api/auth")
public class AuthController {
    
    @PostMapping("/login")
    public ResponseEntity login(@RequestBody LoginRequest request) {
        Authentication authentication = 
            authenticationManager.authenticate(
                new UsernamePasswordAuthenticationToken(
                    request.getUsername(), 
                    request.getPassword()
                )
            );
        
        SecurityContextHolder.getContext()
            .setAuthentication(authentication);
            
        return ResponseEntity.ok(new JwtResponse(jwtProvider.generateToken(authentication)));
    }
}

Without rate limiting or anomaly detection, this endpoint can be bombarded with thousands of requests per minute. The predictable JSON structure ({username: "", password: ""}) makes it easy for attackers to automate.

Session fixation attacks also complement credential stuffing in Spring Boot. If session IDs aren't properly rotated after login, attackers who successfully authenticate can maintain persistent sessions:

// Vulnerable - session not rotated
@Override
protected void successfulAuthentication(HttpServletRequest request, 
                                        HttpServletResponse response, 
                                        FilterChain chain, 
                                        Authentication authResult) throws IOException, ServletException {
    String token = jwtProvider.generateToken(authResult);
    response.addHeader("Authorization", "Bearer " + token);
    // Missing session invalidation
}

Spring Boot's actuator endpoints can also be abused if exposed. Default actuator endpoints like /actuator/health and /actuator/env can reveal application details that aid credential stuffing campaigns.

Detecting credential stuffing in Spring Boot requires monitoring authentication patterns and examining security configurations. middleBrick's black-box scanning approach is particularly effective here because it tests the actual authentication endpoints without requiring source code access.

middleBrick scans for credential stuffing by testing authentication endpoints with common credential pairs and analyzing response patterns. For Spring Boot applications, it specifically looks for:

• Predictable authentication endpoints (/login, /api/auth/login, /authenticate)
• Lack of rate limiting on authentication endpoints
• Consistent error messages that reveal valid usernames
• Session fixation vulnerabilities
• Exposed actuator endpoints

The scanner tests 12 security checks in parallel, including authentication bypass attempts and rate limiting analysis. For Spring Boot specifically, it examines the response structure and timing to identify predictable authentication flows.

Code-level detection in Spring Boot involves examining security configurations:

// Check for vulnerable configurations
@Configuration
@EnableWebSecurity
public class SecurityAnalysisConfig {
    
    @Bean
    public AuthenticationConfiguration authenticationConfiguration() throws Exception {
        AuthenticationConfiguration config = new AuthenticationConfiguration(this.applicationContext);
        AuthenticationManager authManager = config.getAuthenticationManager();
        
        // Analyze authentication providers
        for (AuthenticationProvider provider : authManager.getProviders()) {
            // Look for weak password policies
            if (provider instanceof DaoAuthenticationProvider) {
                PasswordEncoder encoder = ((DaoAuthenticationProvider) provider).getPasswordEncoder();
                // Check if encoder is too weak (e.g., NoOpPasswordEncoder)
            }
        }
        
        return config;
    }
}

Monitoring authentication attempts is crucial:

@Component
public class AuthenticationFailureListener {
    private final AuthenticationFailureHandler failureHandler;
    private final CounterService counterService;
    
    @EventListener
    public void handleAuthenticationFailure(AuthenticationFailureBadCredentialsEvent event) {
        String username = event.getAuthentication().getName();
        counterService.increment("auth.failures." + username);
        
        // Trigger alert if threshold exceeded
        if (counterService.get("auth.failures." + username) > 10) {
            // Credential stuffing likely in progress
        }
    }
}

Spring Boot Actuator can help monitor authentication patterns:

management:
  endpoints:
    web:
      exposure:
        include: health,info,env
  endpoint:
    health:
      show-details: when-authorized
      roles: ADMIN

This configuration allows monitoring authentication health metrics while restricting sensitive endpoint access.

Spring Boot provides several native mechanisms to mitigate credential stuffing. The most effective approach combines rate limiting, strong authentication policies, and monitoring.

For rate limiting, Spring Boot integrates well with bucket4j or Spring Retry:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .formLogin()
                .loginPage("/login")
                .permitAll()
                .defaultSuccessUrl("/home")
                .and()
            .authorizeRequests()
                .antMatchers("/public/**").permitAll()
                .anyRequest().authenticated()
                .and()
            .addFilterBefore(new RateLimitingFilter(), UsernamePasswordAuthenticationFilter.class);
    }
}

@Component
public class RateLimitingFilter extends OncePerRequestFilter {
    
    @Autowired
    private RateLimiter rateLimiter;
    
    @Override
    protected void doFilterInternal(HttpServletRequest request, 
                                    HttpServletResponse response, 
                                    FilterChain filterChain) throws ServletException, IOException {
        String clientId = request.getRemoteAddr();
        if (!rateLimiter.tryConsume(clientId)) {
            response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
            response.getWriter().write("Rate limit exceeded");
            return;
        }
        filterChain.doFilter(request, response);
    }
}

Spring Security provides built-in protections:

@Configuration
@EnableWebSecurity
public class EnhancedSecurityConfig extends WebSecurityConfigurerAdapter {
    
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
            .withUser("user")
            .password(passwordEncoder().encode("password"))
            .roles("USER")
            .and()
            .passwordPolicy(new PasswordPolicyBuilder()
                .minLength(12)
                .requireUppercase()
                .requireLowercase()
                .requireDigit()
                .requireSpecialCharacter()
                .build());
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(12);
    }
}

Session management improvements prevent fixation:

@Configuration
@EnableWebSecurity
public class SessionSecurityConfig extends WebSecurityConfigurerAdapter {
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .sessionManagement()
                .sessionFixation()
                    .migrateSession()
                .maximumSessions(1)
                    .maxSessionsPreventsLogin(true)
                    .expiredUrl("/login?expired")
                .and()
            .and();
    }
}

For API authentication, implement JWT with proper token rotation:

@Service
public class JwtTokenService {
    
    public String generateToken(Authentication authentication) {
        User user = (User) authentication.getPrincipal();
        
        return Jwts.builder()
            .setSubject(user.getUsername())
            .setIssuedAt(new Date())
            .setExpiration(Date.from(
                LocalDateTime.now().plusHours(1).toInstant(ZoneOffset.UTC)))
            .signWith(SignatureAlgorithm.HS512, SECRET_KEY)
            .compact();
    }
    
    public boolean validateToken(String token) {
        try {
            Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token);
            return true;
        } catch (Exception e) {
            return false;
        }
    }
}

Monitoring and alerting integration:

@Component
public class CredentialStuffingDetector {
    
    @Autowired
    private CounterService counterService;
    
    @Scheduled(fixedRate = 60000)
    public void checkForCredentialStuffing() {
        Map counters = counterService.getCounters();
        
        counters.forEach((key, counter) -> {
            if (key.startsWith("auth.failures") && counter.count() > 50) {
                String username = key.replace("auth.failures.", "");
                // Trigger alert - potential credential stuffing
                log.warn("Possible credential stuffing attack on user: " + username);
            }
        });
    }
}

Finally, secure actuator endpoints:

management:
  endpoints:
    web:
      exposure:
        include: health,info
  endpoint:
    health:
      show-details: when-authorized
      roles: ADMIN

These Spring Boot-specific mitigations significantly reduce credential stuffing risk while maintaining usability for legitimate users.