Performance Testing Using JMeter over Password Encrypted website

Question

I am trying to do Performance Testing Using JMeter over Password Encrypted website, the detail scenario is as follows,

The website uses a password Encryption algorithm such as, 1. Client send a request 2. Server Authenticate the request and send a random key 3. The random key is interpreted by client & it process it with password 4. Client send encrypted password to server 5. The sever Authenticate & if validate it set user cookies in browser 6. The cookie is validated in all request send to sever after login for validation

My question here, while preforming Load / Performance testing using Jmeter.

• I could not perform the operation for by-passing authentication or generate client encrypted password.
• Is the any technique / process where I can perform such operations??? or is there any way such that browser set cookies can be track & injected in the call send through JMeter eg. regular expression for sending CSRF Token ,if yes please let me know.
• The failure of such operation would not help in calculating the performance of site because for every call in jmeter the user is set to be invalid as it could not found proper cookies set in browser

Answer 1

Here is how found a workaround for this problem,

1. save the random challenge send by the server in Jmeter
2. Process the random challenge at Jmeter by JavaScript / Bean Shell Scripting / by sending parameters to jar file
3. Send the processed request to server
4. server will set all the cookies & session at JMeter

Answer 2

Here is a workaround ...

• add config element HTTP Cookie Manager to ThreadGroup
• add HTTP Request sampler to ThreadGroup
• add Regular Expression Extractor Post Processor to HTTP Request sampler
• extract token with Regular Expression Extractor.
• use this token to send with password OR if you want to process password with token before send...use Preprocessor and process password
• add another HTTP Request sampler to ThreadGroup, and send user credentials

If request succeeded in step 6..it will return a cookie..which HTTP Cookie Manager config element will take care of automatically. Further request will be sent with this cookie...this will be one time authentication.

Answer 3

Have you tried with HTTP Authorization Manager sampler?

Trace your request using Fiddler or browser developer tool and create your requests manually rather than recording.