如何在 k6 性能测试工具中推送请求 CSRF 令牌 - ReferenceError

Question

我对 k6 和负载测试还很陌生，我不知道为什么我不能将令牌从一个请求推送到另一个请求，以在 Laravel 构建的 web 应用程序中测试登录过程。 我希望有人可以帮助我解决这个问题。

所以我的脚本如下所示：

我想要令牌的第一个请求：

import { parseHTML } from 'k6/html';
import { sleep, group, check } from "k6";
import http from 'k6/http'

export const options = {}

export default function main() {
  let response

   group('page_1 - http://localhost:81/login', function () {
    response = http.get('http://localhost:81/login', {
      headers: {
        host: 'localhost:81',
        'user-agent':
          'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0',
        accept:
          'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
        'accept-language': 'en-US,en;q=0.5',
        'accept-encoding': 'gzip, deflate, br',
        connection: 'keep-alive',
        cookie:
          'XSRF-TOKEN=eyJpdiI6InY5ckZiaGdFTkI4Q0YyRi8rdmtyNUE9PSIsInZhbHVlIjoiT0NjZXlWWVBubTE5Zjh6cXBmNmZFWTdZKzBjVXlEOGhheGR0aVUybURSSGRZbEFmQ0N2RW5BQ3pOYzBQUXgweXhUaGNpRDhrcTV5SHBJUkEvU0FYTmN3eCswYTFsVnhQdk8wL1dkeHMvOTNXRTU4dnk2WjJ0QWFCSWdyQzEwQkwiLCJtYWMiOiIyODI1YmFkMDI1MzlkOGY4ODEyMDg4YWU5M2I5MWE3NmI3Yjg2ODczYTBkMzhhNmZiZTU5ODNlZDBjOGViNWIzIn0%3D; dev_session=eyJpdiI6ImNGalhPQW9GTWlYLzdsaEg1Qk0zdnc9PSIsInZhbHVlIjoiVU5jQ21OZmkyUDVnUmd2WUxUc3Z5dWhRbzBJTm1HWFhmQ1RuNzdFaEpRb1IzdVlIa1VhUkNXYTBlc2IxMHRMajl6UTAzYmFVTHZheEdTV2RrYU84d3pmdEUxYUlkaVFFT3J5YUVWSE1wVklRektqemVmbjhmK3hLWHo2ZmlMYlgiLCJtYWMiOiI3MTQ2ODg0Yjk4YjhhNjg2Yzg1YjllZjdmMWMyNzVkY2ZmNGM1NjAzYWUyN2NlMmE0ZjAwOTAyNWMwNGI2YmM2In0%3D',
        'upgrade-insecure-requests': '1',
        'sec-fetch-dest': 'document',
        'sec-fetch-mode': 'navigate',
        'sec-fetch-site': 'none',
        'sec-fetch-user': '?1',
        'sec-gpc': '1',
      }, 
    })
      
  // Query the HTML for an input field named "_token".
  const elem = response.html().find('input[name=_token]');

  // Get the value of the attribute "value" and save it to a variable
  const token = Elem.attr('value');

  // Now you can concatenate this extracted value in subsequent requests that require it.

  // console.log() works when executing k6 scripts locally and is handy for debugging purposes
  console.log('The value of the hidden field is: ' + token);
  
  check(response, { 
      list_OK: (r) => r.status === 200,
    });
  })

第二个请求 - 我想使用上一个请求中的令牌登录：

    group('page_2 - http://localhost:81/customlogin', function () {
        const url = 'http://localhost:81/customlogin';
        const payload = JSON.stringify({
    _token: `${token}`,
    email: 'user',
    password: '1234',
    });
  const params = {
    headers: {
        'Content-Type': 'application/json',
      host: 'localhost:81',
          'user-agent':
            'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0',
          accept:
            'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
          'accept-language': 'en-US,en;q=0.5',
          'accept-encoding': 'gzip, deflate, br',
          'content-type': 'application/x-www-form-urlencoded',
          origin: 'http://localhost:81',
          connection: 'keep-alive',
          referer: 'http://localhost:81/login',
          cookie:
            'XSRF-TOKEN=eyJpdiI6ImlnZFZCUGF1b1FYUlJOdTJHNDd2Vnc9PSIsInZhbHVlIjoiTXhhdnZyQzlPamRFQ21rajdQVEZXcThzWittZndqU2d1L0hyN1BmRTA2a2RBbEpYZUhIUlRpWjh1RWJoQ1Y5dWJoTWVnaXEzZ1NVTjBndG1tenUyN2phY1lMdkIxSzBGek5aYndlSmRxaEhVTGY4WkNCcE1UY3N6YmowUnkrTkciLCJtYWMiOiJlNDIxNjhkYTc1NjYxNTVkNWZhOWViZDYwMGU1ODRkNmQ2ZGU0NjgyMjU5NjIxMzQ0MjYyYzRjMmJkYTVmNjUwIn0%3D; dev_session=eyJpdiI6IndxWXpobW9BUm1GSHNVZkorN0N0OGc9PSIsInZhbHVlIjoiSE82by9aRnBXQjFkNG5JMHFkVzUzc3kraUZOYUdIdjNlUGN6a3c2SjBSZy9TaVNxNmRsWnQzMTltMGt0MGQvWUoxQndyQXFvd2theWViNU94Z2FXaXlGTkc4ZVdERGY2KzRpUUZDZDIxNG85UFhhanRiajBCWElmcmthMWE0R3IiLCJtYWMiOiJjMDllMmRmNGJjNDRlMjM2MmZmZTViOWEwZmUzNWQ3MzNjZDI1NWQwYmU3MjE4OTZiMTRhN2U0NWNkMTcxMDAzIn0%3D',
          'upgrade-insecure-requests': '1',
          'sec-fetch-dest': 'document',
          'sec-fetch-mode': 'navigate',
          'sec-fetch-site': 'same-origin',
          'sec-fetch-user': '?1',
          'sec-gpc': '1',
    },
  };
  response = http.post(url, payload, params);
    console.log(response)
    check(response, {
      list_OK: (r) => r.status === 200,
    });
  })

运行脚本后，我收到一条错误消息：

> ReferenceError：未定义令牌

感谢您的热情帮助！

Answer 1

在这种情况下，您在第一次调用group (const token....`) 时定义了一个变量，然后尝试在第二次调用中使用它。

这与 CSRF 或 k6 无关，但与 javascript... 以及可以说在大多数其他语言中的作用域有关。

但是为了让两个函数看到相同的变量，您需要提前定义它 - 例如，在default function 开头的let response旁边。

还要从当前定义中删除const ，否则它将不起作用；）