How to extract CSRF cookie from request and send into HTTP Request without using parameter in JMeter

0
votes

I am new to JMeter. I am performing login test. I am trying to extract CSRF token but i don't get it. I don't know how to resolve it.

request data

regular expression extractor

When i try to put CSRF token - "reference name" into HTTP Request - "Parameters" i got the error.

HTTP Request - Parameters

I am stuck here. I don't know how to put CSRF token - "reference name" without "Parameters". Please help me.

3
parametersrequestjmetercsrf
I know it's not an answer, but that token in the cookie does not provide any protection against csrf, and there is no parameter to implement double posting. :) (Or maybe we can't see post parameters? I don't know JMeter.) - Gabor Lengyel

3 Answers

0
votes

To send parameter in POST request with JSON body you can add parameters in Path field after ? Sign, in your case add 

?csrf=${token}
0
votes

First of all, you should navigate with a browser, analyse the traffic and mimick it.

Chrome has a tool to do it or you can use Fiddler. Generally speaking, CSRF is returned as cookie from the server the first time, then it must be returned both as a cookie and in the header.

Sometime the value changes, even in the same session. Be aware of this.

So you must:

  • insert a cookie manager (at top level in the project)
  • extract the value from the response header (every time it changes)
  • insert it as a header parameter in all the following requests
0
votes

The easiest way of extracting a cookie into a JMeter Variable is using HTTP Cookie Manager

  1. Add HTTP Cookie Manager to your Test Plan

  2. Add the next line to user.properties file (lives in "bin" folder of your JMeter installation)

    CookieManager.save.cookies=false
  3. Restart JMeter to pick the property up

When the cookie will come from the server you will be able to access it as ${COOKIE_csrftoken} where required.

More information: HTTP Cookie Manager Advanced Usage - A Guide