2

enter image description here

Need help, I'm in a situation where, I need to perform Load testing and I am using JMeter to perform load test. How can I configure CSRF token in JMeter as it's showing 403 Error on the links. The back-end sets the CSRF token in the browser and also uses random challenge for authentication purpose. Please suggest me how I should proceed in such situation. Is using open source technology preferable?

Improve this question

2 Answers 2

Reset to default
2

Yes, you can use open source tool JMeter for load testing of this application and it will work perfectly fine. Regarding your issue of "Cross-site request forgery" (CSRF) token, you need to use Regex for the same. Actually, this CSRF token is generated at run time and can be used only once, so if you use its hard-coded value in your script (i.e. recorded value) then you will ran into trouble, because that is a used token and is no more valid for use.

I have done load testing of a eCommerce site in my organization which too used this CSRF token for authentication purpose. I too used JMeter and there I used Regular Expression Extractor for extracting and passing value of CSRF token to subsequent request.

In my case this CSRF token is generated at the very first hit/request to the application, so I added 'Regular Expression Extractor' as child of that request and passed it to next request(s) where it was being used.

In addition to it, use Cookie Manager too for maintaining the session (if your application have one), if not being used already.

Try the same and your issue will get resolved. Just to eliminate your feeling about 'use open source technology', I can tell you JMeter is a very good tool for performance testing of web applications.

Improve this answer
4
  • ,Thanks ,the process which I followed , firstly I created a jmx file using blaze meter which includeHTTP Authorization Manager, HTTP Cookie Manager & HTTP Cache Manager Under Test Plan, I suppose the Authorization & cookie manger will handle the csrf token, as you can see in the image the call are generating csrf token but not what is required , I have also tried using regular expression but could not succeed ,I have referred following links to implement regular expression , blog.wedoqa.com/2015/02/…
    – Rajesh Rathod
    Oct 30, 2015 at 7:03
  • Also suggest me do I need to apply regular expression only once or to al the links which require csrf validation individually..? Please correct me if my approach is incorrect.
    – Rajesh Rathod
    Oct 30, 2015 at 7:03
  • Your approach is correct and regarding the use of Regex, yes you have to use this Regex for all those requests which are using this CSRF token. Authorization & cookie manger are not for handling this type of Authentications, for this you have to use the Regex, but cross check your Regex if that is generating any required value or not.
    – Dhiman
    Oct 30, 2015 at 13:31
  • I use this process,blazemeter.com/blog/how-load-test-csrf-protected-web-sites
    – Rajesh Rathod
    Oct 31, 2015 at 8:14
1
  1. Record your use case several times
  2. Mention which request parameters are changing. Pay attention to Request Headers as well.

  3. Once you identify what values need to be correlated - use one of the following post processors to extract dynamic bits, convert them to JMeter Variables and using in next requests

See How to Load Test CSRF-Protected Web Sites guide for example of bypassing CSRF protection with JMeter in Django web application

Improve this answer
1
  • website uses django framework for authorization or x-csrf token,can you provide me some links,tutorial to perform load test,as please let me know when multiple uses hits using jmeter how the csrf token are generated
    – Rajesh Rathod
    Oct 31, 2015 at 6:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.