SameSite cookies in JMeter

Question

I'm developing a JMeter test for a site that requires "SameSite by default cookies" to be Disabled in Chrome, as shown here:

Turn off samesite enforcement in chrome version > 80

The site I'm testing just returns HTML pages; it does not have a separate API layer. The main element causing issues is a third-party component embedded in an iframe. The iframe content uses SSO to authenticate with the main site. In Chrome, if the SameSite setting is set to Default, I get a login page for the third-party component, rather than seeing the component render. If the SameSite setting is set to Disabled, then the third-party component renders correctly.

When I execute my test in JMeter, I'm encountering the same issue that I encounter in Chrome when "SameSite by default cookies" is set to Default--specifically, I get redirected to a login page.

However, when I execute the same sequence of HTTP requests in Postman, everything works fine.

Does JMeter have some SameSite cookie behavior built-in, and if so, how do I disable it?

UPDATE: following Dmitri's suggestion, I tried all the different cookie managers.

I also enabled cookie manager logging. If I set HTTP Cookie Manager's Cookie Policy to default, the "expires" attribute on the cookies causes an error:

2020-03-27 12:56:58,613 ERROR o.a.j.p.h.c.HC4CookieHandler: Unable to add the cookie
org.apache.http.cookie.MalformedCookieException: Invalid 'expires' attribute: Fri, 03 Apr 2020 17:56:54 GMT
    at org.apache.http.impl.cookie.BasicExpiresHandler.parse(BasicExpiresHandler.java:64) ~[httpclient-4.5.10.jar:4.5.10]
    at org.apache.http.impl.cookie.CookieSpecBase.parse(CookieSpecBase.java:113) ~[httpclient-4.5.10.jar:4.5.10]
    at org.apache.http.impl.cookie.DefaultCookieSpec.parse(DefaultCookieSpec.java:140) ~[httpclient-4.5.10.jar:4.5.10]
    at org.apache.jmeter.protocol.http.control.HC4CookieHandler.addCookieFromHeader(HC4CookieHandler.java:124) [ApacheJMeter_http.jar:5.2.1]

...

If I set the Cookie Policy to standard--"The RFC 6265 compliant policy (interoprability profile)" per HTTPClient docs--I don't see any cookie error messages in the log, but I'm still getting redirected to a login page.

Dmitri T Dmitri T · Accepted Answer · 2020-03-27T08:55:13

If the application you're testing sends malformed cookies in Set-Cookie header JMeter might reject the cookies which don't match current domain of the HTTP Request sampler or expired or invalid by any other reason.

You can "tell" JMeter to be less restrictive by:

Choosing more "relaxed" cookie policy, i.e. netscape in the HTTP Cookie Manager
Add CookieManager.check.cookies=true line to user.properties file (JMeter restart will be required to pick the property up)

More information: HTTP Cookie Manager Advanced Usage - A Guide

If above steps don't help you can:

Increase JMeter logging verbosity for the HTTP Cookie Manager and friends by adding the next line to log4j2.xml file:
```
<Logger name="org.apache.jmeter.protocol.http.control" level="debug" />
```
and last but not the least, you can always extract cookies from the aforementioned Set-Cookie header using i.e. Regular Expression Extractor and manually add them the next request using HTTP Header Manager

SameSite cookies in JMeter

1 Answers