Where to find the authorization token in JMeter recorded scripts of an android app?

Question

I am getting unauthorized error for my HTTP request.

I recorded the server side interaction of Android app using JMeter proxy script recorder. Only the login request is working, but the token is not passing.

I tried passing the token by Correlation, but I am getting a Token that is almost four times the original one which was passed during script recording. Passing on that one token, I am getting the unauthorized error. I think I am passing the wrong token.

Can anybody tell me where to find the passed token?

Answer 1

It should normally be somewhere in the first response, either in response body, or headers, check the first response for anything looking like a token, extract it using a relevant JMeter PostProcessor, convert into a JMeter Variable and replace recorded hard-coded value with the variable coming from the PostProcessor. The process is known as correlation and there is a lot of information over the web on how to properly perform it.

Alternatively you can consider an alternative way of recording a test scenario, it is capable of export recorded scripts in "SmartJMX" mode with automatic detection and correlation of any dynamic parameters, see How to Cut Your JMeter Scripting Time by 80% article for more details.

Answer 2

Here it would be helpful to see what you're sending in the request, also.

Are you sure you're sending that same token in the following samplers, and in the correct header/cookie?

Are you sure you are following the correct flow for authentication? Like getting the token and reusing that...

If you do, then the token returned by the login API should be useful, even if in this case I'd say it's rather strange because of its length.