I am load testing a CSRF protected website and have successfully extracted the csrf token and authorized the login, however when loading a pages with many different graphs, all the graphs seem to fail. The transaction returned from JMeter has a large JSON response for the body data and an X-CSRF-TOKEN in the header.

Everything works fine when manually going through the webpage, only on JMeter is it failing.

I extract the CSRF cert at the login page, and send it to the login transaction parameters which works.


Login Parameters

Example Captured Token

Here is one of the failed transactions (all others are the same) - It is a large JSON POST request

Failed Transaction Body Data

Failed Transaction Header Request

And this is the response from the failed transaction. As you can see the X-CSRF-TOKEN is entirely different from the one I passed in the header and says it's forbidden because of the CSRF. I also tried going through again to see if I could find a CSRF token that looks similar to the one in the response header, but I cannot.

Failed Transaction Response Header

Failed Transaction Response Body

So my question would be, why does this fail but the login passes with the same CSRF token? Is there an extra token generated somewhere? I have not been able to find any token generated that looks similar to the one in the header.

Any help would be greatly appreciated as I have been stuck on this for some time now.


1 Answer 1


Most probably you need to extract the token not only from Login Page, but also from each subsequent page

As per Synchronizer Token Pattern chapter:

CSRF tokens should be generated on the server-side. They can be generated once per user session or for each request. Per-request tokens are more secure than per-session tokens as the time range for an attacker to exploit the stolen tokens is minimal.

So try moving your uaa_cert extractor one level up so it will be applied to all HTTP Request samplers instead of only one (thanks to JMeter Scoping Rules) and it should resolve your issue. If it doesn't - double check the way you're passing the token

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.