HTTP request having an Edit action is giving an unauthorized error in JMeter Script

Question

I recorded my scripts using JMeter proxy recorder. The JMeter scripts ran perfectly after I configured the Header Manager and the Authorization Manager. All the HTTP requests were responded perfectly. Only one of the HTTP request where I had performed an edit action in the application is giving unauthorized error. I am passing the token by correlation. Anybody has any suggestion on why is this happening and what is the solution?

Here is the Sampler Result:

Thread Name: Thread Group 1-1
Sample Start: 2018-04-27 12:03:47 IST
Load time: 72
Connect Time: 1
Latency: 72
Size in bytes: 497
Sent bytes:1539
Headers size in bytes: 434
Body size in bytes: 63
Sample Count: 1
Error Count: 1
Data type ("text"|"bin"|""): text
Response code: 401
Response message: Unauthorized

Response headers:

HTTP/1.0 401 Unauthorized
Date: Fri, 27 Apr 2018 06:33:47 GMT
Server: Apache/2.4.18 (Ubuntu)
Vary: Authorization
Cache-Control: no-cache, private
Access-Control-Allow-Methods: HEAD, GET, POST, PUT, PATCH, DELETE
Access-Control-Allow-Headers: 
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Location
Content-Length: 63
Content-Type: application/json
Via: HTTP/1.1 sophos.http.proxy:3128
Connection: close

HTTPSampleResult fields:

ContentType: application/json
DataEncoding: null

**Request:** 

POST http://*********************************
POST data:
{"isDropdown":1}
[no cookies]

Request Headers:

Connection: keep-alive
Referer: http:// //Referer site//
Accept-Language: en-US,en;q=0.5
Origin: http://  //Origin site//
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 
Firefox/45.0
Accept: application/json, text/plain, */*
Authorization: Bearer //token//
Content-Length: 16
Host: *********

Response Data:

{"message":"You don't have permissions to perform this action"}

Answer 1

From all the requests you have recorded only the one where you edited is generating a 401 (Unauthorized) error.

This means the token required for the user/credentials you are passing in the request isn't valid, or it isn't being passed correctly.

Record same script again and then compare the differences in the HTTP Request Sampler, Authorization Manager and also verify if the token is being passed dynamically from another request?

For example, when you are recording the script, do you login and then perform another action? In such a case authorization token would be generated by the Login Request sampler, which might be extracted and passed in to the other request.

To verify manually, you can also copy the same request and it's parameters and try executing it via Postman to verify it is working over there.

Answer 2

Looks like a bug in the app. Ask the developer to check this request and see why you get such a response {"message":"You don't have permissions to perform this action"}
Also interesting

1. Is the editing operation in JMeter happening successfully?
2. When you do an edit operation in a browser, is the same response coming? You can check it in the Google Developer Tools (Network and Console tabs).

Answer 3

it is not a JMeter error. the user you are using to perform action doesn't have access. I say it is application things rather than JMeter.

Moreover, you can compare the request headers with another one and find the difference.