I am load testing a CSRF protected website and have successfully extracted the csrf token and authorized the login, however when loading a pages with many different graphs, all the graphs seem to fail. The transaction returned from JMeter has a large JSON response for the body data and an X-CSRF-TOKEN in the header.
Everything works fine when manually going through the webpage, only on JMeter is it failing.
I extract the CSRF cert at the login page, and send it to the login transaction parameters which works.
Here is one of the failed transactions (all others are the same) - It is a large JSON POST request
And this is the response from the failed transaction. As you can see the X-CSRF-TOKEN is entirely different from the one I passed in the header and says it's forbidden because of the CSRF. I also tried going through again to see if I could find a CSRF token that looks similar to the one in the response header, but I cannot.
So my question would be, why does this fail but the login passes with the same CSRF token? Is there an extra token generated somewhere? I have not been able to find any token generated that looks similar to the one in the header.
Any help would be greatly appreciated as I have been stuck on this for some time now.