JMetesr—How to Load Test CSRF-Protected Web Sites

As shown in below Figure (click to enlarge), an X-CSRF-Token header is used in an HTTP request.  In this article, we will discuss how to load test CSRF-Protected web sites using JMeter.  To begin with, what is CSRF?

Figure 1.  X-CSRF-Token header shown in View Results Tree

Cross-Site Request Forgery (CSRF)

Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser. Cross-Site Request Forgery (CSRF) attacks occur through a malicious website that sends the requests to the targeted application website if the user is already authenticated through a different website.

These attacks happen if the user logs in to the actual website and leaves the session open, and accesses the malicious website links and forms that try to form the dynamic URLs to the targeted application where the user has already logged in.

The best way to prevent CSRF attacks is to attach CSRF tokens to each request from the application users and bind them to the user session. This way, the applications can restrict the access to the user's secure information by confirming the request is coming from known user sessions.

View Results Tree

After script recording, the best way to debug correlation issues is to use View Results Tree component (a Listener).

The View Results Tree shows a tree of all sample responses, allowing you to view the response for any sample. In addition to showing the response, you can see the time it took to get this response, and some response codes.

Note that View Results Tree MUST NOT BE USED during load test as it consumes a lot of resources (memory and CPU). Use it only for either functional testing or during Test Plan debugging and Validation.

From Figure 1, we have found an X-CSRF-Token header used in Step 32.  This means that we need to search for CSRF token backwards in the Response Data of earlier Steps.

Correlation

From the end-user’s point of view, CSRF protection is transparent. On the protocol level, CSRF protection is an additional mandatory dynamic parameter, such as the:^[2]

• Cookie
• Header
• Request Parameter

When a real-life user surfs a CSRF-protected website with a web browser, the browser’s CSRF security token can be set (for example: this can be set with a JavaScript function). Now, here’s where JMeter’s “not being a browser” issue really becomes a limitation. As it’s not a browser, it can’t execute a client-side JavaScript and therefore can’t generate and record a proper CSRF token.

To resolve the challenges raised by CSRF sites, you’ll need to use a JMeter Correlation.  In this article, we will demonstrate the use of a JMeter PostProcessor Regular Expression Extractor to extract the CSRF token.

Figure 2.  Specification of  a PostProcessor Regular Expression Extractor 

Regular Expression Extractor

At Step 15 (see Figure 2), you need to add a new PostProcessor Regular Expression Extractor to extract the CSRF token.

Sample Response Data:

[

  {

   <snipped>

    "bimodelerURL": "/bimodeler",

    "csrftoken": "h3CYF2EDNYlfBPKM01grVQQMfUKE0lAvhwfRzHtxU1Mdigx6",

    "vaAdminPermission": true,

   <snipped>

   }

]

Regular Expression:

"csrftoken":"([^\"]+)


Then, you can use a text editor to open the jmx file and do a global replacement of

h3CYF2EDNYlfBPKM01grVQQMfUKE0lAvhwfRzHtxU1Mdigx6

with

${csrftoken}

For example, at Step 32, you should see something updated like below:

Figure 3.  Variable Substitution in HTTP Header

References

1. Oracle JET for Developers
2. How to Load Test CSRF-Protected Web Sites

JMeter—Use Extractors (Post-Processor Elements) for Correlation

What Is Correlation

Correlation is the process of capturing and storing the dynamic response (e.g., "Session ID" in the above diagram) from the server and passing it on to subsequent requests. A response is considered dynamic when it can return different data for each iterating request, occasionally affecting successive requests. Correlation is a critical process during performance load test scripting, because if it isn’t handled correctly, your script will become useless.

Correlation is 2-step process:

1. Parse and extract the dynamic value from the response of a step using a Post Processor element such as:
• Regular Expression Extractor
• CSS/JQuery Extractor
2. Refer the extracted value in the request of a subsequent step
• http://.../.../...?sessionID=${sessionId}#....

How to Use Regular Expression Extractor

Watching above video, you can learn how to create Regular Expression Extractors in JMeter in the following steps:^[2]

1. Create a Test Plan where you want to do dynamic referencing in JMeter
2. Add Regular Expression Extractor in the Step from where response value(s) needs to be extracted
• You can use RegExr—an online tool—to learn, build, and test Regular Expressions
3. Refer the extracted value (referred by Reference Name) in subsequent step(s)
4. Run and validate it
• You can use RegExp Tester in View Results Tree, to test regular expressions directly on response data

How to Use CSS/JQuery Extractor

Watching above video, you can learn how to create CSS/JQuery Extractors in JMeter in similar steps:^[8]

1. Create a Test Plan where you want to do dynamic referencing in JMeter
2. Add CSS/JQuery Extractor^[9]in the Step from where response value(s) needs to be extracted
• You can find a detailed explanation of CSS syntax here. jQuery's selector engine uses most of the same syntax as CSS with some exceptions. For selecting an arbitrary locator, you can use field Match No. with the ‘0’ value, which returns a random value from all found results.
• It is also worth mentioning there is a list of very convenient browser plugins to test CSS locators right into your browser. For Firefox, you can use the ‘Firebug’ plugin, while for Chrome ‘XPath Helper’ is the most convenient tool.
3. Refer the extracted value (referred by Reference Name) in subsequent step(s)
4. Run and validate it

How to Use JSON Extractor

Read the companion articles on this subject:

• JMeter: How to Verify JSON Response?
• JMeter―Select on Multiple Criteria with JSONPath

References

1. Advanced Load Testing Scenarios with JMeter: Part 1 - Correlations
2. JMeter Beginner Tutorial 19 - Correlation (with Regular Expression Extractor)
3. Using RegEx (Regular Expression Extractor) with JMeter
4. RegExr—an online tool (good)
5. JMeter Listeners - Part 1: Listeners with Basic Displays
6. Understand and Analyze Summary Report in Jmeter
7. How to Automate Auth Token using JMETER
8. How to Use the CSS/JQuery Extractor in JMeter (BlazeMeter)
9. How to Use the CSS/jQuery Extractor in JMeter  (DZone)
10. JMeter: How to Turn Off Captive Portal from the Recording Using Firefox (Xml and More)
11. JMeter―Select on Multiple Criteria with JSONPath  (Xml and More)
12. JMeter: How to Verify JSON Response?  (Xml and More)

JMeter: Using the HTTP Cookie Manager

In a stateless internet, many sites and applications use cookies to retain a handle between sessions or to keep some state on the client side. If you are planning to use JMeter to test such web applications, then cookie manager will be required.

To learn how to enable HTTP Cookie Manager and run tests in JMeter, you can watch below video.

HTTP Cookie Manager Usage & Example in JMeter (YouTube link)

In this article, we will cover two topics:

1. Why cookie manager?
2. Where to put cookie manager?

Why Cookie Manager

If you need to extract a cookie data from response body, one option is to use a Regular Expression Extractor on the response headers.^[4] Another simpler option is adding a HTTP Cookie Manager which automatically handles cookies in many configurable ways.

HTTP Cookie Manager has three functions:

1. Stores and sends cookies just like a web browser
• Each JMeter thread has its own "cookie storage area".
• Note that such cookies do not appear on the Cookie Manager display, but they can be seen using the View Results Tree Listener.
2. Received Cookies can be stored as JMeter thread variables
• Versions of JMeter 2.3.2+ no longer do this by default
• To save cookies as variables, define the property "CookieManager.save.cookies=true" by
• Setting it in jmeter.properties file, or
• Passing a corresponding parameter to JMeter startup scrip
• jmeter -JCookieManager.save.cookies=true
• The names of the cookies contain the prefix "COOKIE_" which can be configured by the property "CookieManager.name.prefix"
• See [4] for an example
3. Supports adding a cookie to the Cookie Manager manually
• Note that if you do this, the cookie will be shared by all JMeter threads—such cookies are created with an expiration date far in the future.

Where to Put Cookie Manager

Nearly all web testing should use cookie support, unless your application specifically doesn't use cookies. To add cookie support, simply add an HTTP Cookie Manager to each Thread Group in your test plan. This will ensure that each thread gets its own cookies, but shared across all HTTP Request objects.

To add the HTTP Cookie Manager, simply select the Thread Group, and choose Add → Config Element → HTTP Cookie Manager, either from the Edit Menu, or from the right-click pop-up menu.

References

1. Using the HTTP Cookie Manager in JMeter
2. Understanding and Using JMeter Cookie Manager
3. Adding Cookie Support
4. Header Cookie “sid” value to a variable
5. Using RegEx (Regular Expression Extractor) with JMeter
6. JMeter: How to Turn Off Captive Portal from the Recording Using Firefox (Xml and More)
7. JMeter—Use Extractors (Post-Processor Elements) for Correlation (Xml and More)