Correct Login Leads to 403 Forbidden Error in jMeter

Question

I am pulling in various logins from my CSV file using the CSV Data Set Config. I am manually able to log in as each user. When I run the script in jMeter, I am able to login as every user except the first (happens with/without the "ignore first line" checked). I get a 403 Forbidden error and the response data says "invalid login."

I don't get why this is happening. Can I get some suggestions, please?

Answer 1

1. Make sure you have HTTP Cookie Manager added to your Test Plan

2. Make sure to inspect your test plan for any dynamic parameters. Modern web applications widely use them for i.e. CSRF protection or client-side state management. If you record your test scenario 2 times and see that each time there is at least one dynamic parameter - you will need to work it around like:

   • HTTP Request #1 - open login page
     • JMeter Post-Processor(s) to extract dynamic parameter(s)
   • HTTP Request #2 - perform login, send credentials along with dynamic parameter(s)

The process is known as "correlation".

You can also consider using an alternative option of recording a JMeter test using cloud-based proxy service, it is capable of exporting tests in "SmartJMX" mode, it means that all dynamic elements will be automatically detected and relevant Regular Expression Extractors will be added to test plan. See How to Cut Your JMeter Scripting Time by 80% article for more details.

Answer 2

Turns out there was a hidden parameter that I wasn't getting, which was required in order to be able to log in successfully. Once I put that as a parameter in the HTTP request for logging in, it worked. Thank you.