JMeter 403 Error - CSRF Token

Question

I am load testing a CSRF protected website and have successfully extracted the csrf token and authorized the login, however when loading a pages with many different graphs, all the graphs seem to fail. The transaction returned from JMeter has a large JSON response for the body data and an X-CSRF-TOKEN in the header.

Everything works fine when manually going through the webpage, only on JMeter is it failing.

I extract the CSRF cert at the login page, and send it to the login transaction parameters which works.

Here is one of the failed transactions (all others are the same) - It is a large JSON POST request

And this is the response from the failed transaction. As you can see the X-CSRF-TOKEN is entirely different from the one I passed in the header and says it's forbidden because of the CSRF. I also tried going through again to see if I could find a CSRF token that looks similar to the one in the response header, but I cannot.

So my question would be, why does this fail but the login passes with the same CSRF token? Is there an extra token generated somewhere? I have not been able to find any token generated that looks similar to the one in the header.

Any help would be greatly appreciated as I have been stuck on this for some time now.

Thanks

Answer 1

Most probably you need to extract the token not only from Login Page, but also from each subsequent page

As per Synchronizer Token Pattern chapter:

CSRF tokens should be generated on the server-side. They can be generated once per user session or for each request. Per-request tokens are more secure than per-session tokens as the time range for an attacker to exploit the stolen tokens is minimal.

So try moving your uaa_cert extractor one level up so it will be applied to all HTTP Request samplers instead of only one (thanks to JMeter Scoping Rules) and it should resolve your issue. If it doesn't - double check the way you're passing the token