I am trying to do Performance Testing Using JMeter over Password Encrypted website, the detail scenario is as follows,

The website uses a password Encryption algorithm such as, 1. Client send a request 2. Server Authenticate the request and send a random key 3. The random key is interpreted by client & it process it with password 4. Client send encrypted password to server 5. The sever Authenticate & if validate it set user cookies in browser 6. The cookie is validated in all request send to sever after login for validation

My question here, while preforming Load / Performance testing using Jmeter.

  • I could not perform the operation for by-passing authentication or generate client encrypted password.
  • Is the any technique / process where I can perform such operations??? or is there any way such that browser set cookies can be track & injected in the call send through JMeter eg. regular expression for sending CSRF Token ,if yes please let me know.
  • The failure of such operation would not help in calculating the performance of site because for every call in jmeter the user is set to be invalid as it could not found proper cookies set in browser
  • They way I understand it your client is generating a specific key for the server before the client is authenticated? Correct? If so: that means that in Jmeter you have to make sure you can also generate that same token upon receiving the random key from the server.
    – Ray Oei
    Commented Dec 1, 2017 at 16:10

3 Answers 3


Here is how found a workaround for this problem,

  1. save the random challenge send by the server in Jmeter
  2. Process the random challenge at Jmeter by JavaScript / Bean Shell Scripting / by sending parameters to jar file
  3. Send the processed request to server
  4. server will set all the cookies & session at JMeter

Here is a workaround ...

  • add config element HTTP Cookie Manager to ThreadGroup
  • add HTTP Request sampler to ThreadGroup
  • add Regular Expression Extractor Post Processor to HTTP Request sampler
  • extract token with Regular Expression Extractor.
  • use this token to send with password OR if you want to process password with token before send...use Preprocessor and process password
  • add another HTTP Request sampler to ThreadGroup, and send user credentials

If request succeeded in step 6..it will return a cookie..which HTTP Cookie Manager config element will take care of automatically. Further request will be sent with this cookie...this will be one time authentication.


Have you tried with HTTP Authorization Manager sampler?

Trace your request using Fiddler or browser developer tool and create your requests manually rather than recording.

  • Yes, I have tried but now working. Commented Aug 14, 2017 at 8:51
  • your answer did not resolve my problem.. Commented Aug 15, 2017 at 3:31
  • Why? Have you tried the auth sampler? Commented Aug 15, 2017 at 6:41
  • Yes, I have tried HTTP Authorization Manager, but it did not resolved my problem. Commented Aug 16, 2017 at 3:09
  • any updates on this scenario? Commented Nov 17, 2017 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.