How to extract the __RequestVerificationToken cookie in JMeter?

Question

In an ASP.NET web application, at first, I got the error of the anti-forgery token not being matched. This has been resolved by using the CSS Selector Extractor as a post-processor in an HTTP Request, storing the token and using it the subsequent request.

At present, I am getting the error,

"The anti-forgery cookie token and form field token do not match."

I observed in JMeter that after the __RequestVerificationToken for the first HTTPS request, in the response headers, the following cookie is being set:

Set-Cookie: __RequestVerificationToken_L2liYXMy0=_uxXi0qVWXvvrIRBEQSieuD9q_ZdtKqG36Yb2W6otUnTl4cZh3IohpCAnaGddl6ZXnNRgzzAdTbR0T4Vom9RvQ11BU41; path=/; secure; HttpOnly

So, it looks like the __RequestVerificationToken is being hashed in some manner to produce this cookie.

The actual __RequestVerificationToken value is tfjeAll14YvIwa0gS_lkvxSNEiw6LSlIu83bNN2CRH0SryJXGRttPdE8_SLWKMMAe4ZmbBd8jzuypdJ32vznuy6LVtI1.

I presume that I need to capture the above cookie and use it in the subsequent HTTP request.

To capture this cookie, I tried the following regular expression extractor:

__RequestVerificationToken_L2liYXMy0=(.+?);

But the value is being captured as:

__RequestVerificationToken_L2liYXMy0=%241

The above is clearly incorrect.

What can be used to capture the above cookie value correctly?

Also, I understand that using the hardcoded appended part (_L2liYXMy0) in the cookie name is not a very elegant approach. Some advice to make it general (portable, machine/server independent) would be appreciated as well.

I have searched extensively for similar scenarios and tried all the proposed solutions, without any avail.

I have also tried the technique of using the cookie manager pointed out here, but this did not work.

UPDATE 1

Using the technique here, I have been able to extract the cookie value (previously, I was making a mistake in the cookie name) and pass it to the next HTTP request.

Issues:

1. The authentication is still unsuccessful with the same error.
2. How to get rid of the hardcoded appended part in the cookie name?

Answer 1

Normally given you add a HTTP Cookie Manager to your Test Plan JMeter should automatically retrieve cookies from the server's Set-Cookie header and send them back using Cookie header if the cookie is valid (not expired, domain and path match, etc.)

If you need to use the cookie value in another place, i.e. in request parameter or something like this the easiest option is adding the next line to user.properties file:

CookieManager.save.cookies=true

and once done you will be able to access the cookie value as ${COOKIE____RequestVerificationToken} where required.

More information: HTTP Cookie Manager Advanced Usage - A Guide