Need help, I'm in a situation where, I need to perform Load testing and I am using JMeter to perform load test. How can I configure CSRF token in JMeter as it's showing 403 Error on the links. The back-end sets the CSRF token in the browser and also uses random challenge for authentication purpose. Please suggest me how I should proceed in such situation. Is using open source technology preferable?
Yes, you can use open source tool JMeter for load testing of this application and it will work perfectly fine. Regarding your issue of "Cross-site request forgery" (CSRF) token, you need to use Regex for the same. Actually, this CSRF token is generated at run time and can be used only once, so if you use its hard-coded value in your script (i.e. recorded value) then you will ran into trouble, because that is a used token and is no more valid for use.
I have done load testing of a eCommerce site in my organization which too used this CSRF token for authentication purpose. I too used JMeter and there I used Regular Expression Extractor for extracting and passing value of CSRF token to subsequent request.
In my case this CSRF token is generated at the very first hit/request to the application, so I added 'Regular Expression Extractor' as child of that request and passed it to next request(s) where it was being used.
In addition to it, use Cookie Manager too for maintaining the session (if your application have one), if not being used already.
Try the same and your issue will get resolved. Just to eliminate your feeling about 'use open source technology', I can tell you JMeter is a very good tool for performance testing of web applications.
- Record your use case several times
- Mention which request parameters are changing. Pay attention to Request Headers as well.
Once you identify what values need to be correlated - use one of the following post processors to extract dynamic bits, convert them to JMeter Variables and using in next requests