如何在记录时跳过Apache Jmeter中CSRF感染的网页

Question

I have implemented CSRF (corss site request forgery) in login page of my application. when i try to do load test using apache jmeter, i am getting (login time exceeded) error. if i create custom debug.jar to remove csrf it is working fine. it is getting very tedious for each time to load the debug.jar while doing load test. I am new to jmeter can any one help me out with this.

Thanks.

Answer 1

CSRF usually results in mandatory either header or cookie which needs to exist elsewise the request won't be served. CSRF token usually lives in every response so it's "classic" correlation example. So the flow should look as follows:

1. GET first page
2. Extract CSRF token using one of the following:
   • Regular Expression Extractor
   • CSS/JQuery Extractor
   • XPath Extractor
3. GET next page
4. Send CSRF header or cookie using
   • HTTP Cookie Manager
   • HTTP Header Manager

These "managers" should be added as a child of "next" request.