In an ASP.NET web application, at first, I got the error of the anti-forgery token not being matched. This has been resolved by using the CSS Selector Extractor as a post-processor in an HTTP Request, storing the token and using it the subsequent request.
At present, I am getting the error,
"The anti-forgery cookie token and form field token do not match."
I observed in JMeter that after the
__RequestVerificationToken for the first HTTPS request, in the response headers, the following cookie is being set:
Set-Cookie: __RequestVerificationToken_L2liYXMy0=_uxXi0qVWXvvrIRBEQSieuD9q_ZdtKqG36Yb2W6otUnTl4cZh3IohpCAnaGddl6ZXnNRgzzAdTbR0T4Vom9RvQ11BU41; path=/; secure; HttpOnly
So, it looks like the
__RequestVerificationToken is being hashed in some manner to produce this cookie.
I presume that I need to capture the above cookie and use it in the subsequent HTTP request.
To capture this cookie, I tried the following regular expression extractor:
But the value is being captured as:
The above is clearly incorrect.
What can be used to capture the above cookie value correctly?
Also, I understand that
using the hardcoded appended part (
_L2liYXMy0) in the cookie name is not a very elegant approach. Some advice to make it general (portable, machine/server independent) would be appreciated as well.
I have searched extensively for similar scenarios and tried all the proposed solutions, without any avail.
I have also tried the technique of using the cookie manager pointed out here, but this did not work.
Using the technique here, I have been able to extract the cookie value (previously, I was making a mistake in the cookie name) and pass it to the next HTTP request.
- The authentication is still unsuccessful with the same error.
- How to get rid of the hardcoded appended part in the cookie name?