Can't get authorized response on requests in JMeter, while they have the same CSRF token and sessionID

Question

I'm having trouble with getting my site normally loaded during the performance testing in Apache JMeter. Firstly I recorded the script (by BadBoy), containing authorization and visiting some pages, unavailable without login. Next, I exported it to JMeter, configured Regular Expression Extractor to get the csrftoken from the request right before the authorization request and it looks like it works just fine: no errors in http-requests

But if to look at the tab "Response data" of every post-authorized request, the content isn't like correctly loaded page, it just starts page with the empty authorization form, i.e. in some way session is new though all the requests have the same session id and csrftoken in Cookie Data and in Set-Cookie (Sample result), appeared in authorization request result.

HTTP Cookie Manager is added.

Did anyone face this trouble?

UPDATE: I've conducted an experiment with transferring cookies from Chrome to Mozilla Firefox, copied 'csrftoken' and 'session id', and - voila! - it worked, I got the same authorized session in two browsers. Still have no idea what's wrong with JMeter

Answer 1

The solution was found after recording a script by Blazemeter plugin in Chrome and further exporting it in '.JMX' format. Adding an HTTP Header Manager like this (with its special fields, of course) to each HTTP Request solved the problem.

Answer 2

This is the default behavior of this token. 1. make sure where these tokens are passed. It might be passed multiple times. Check the header. Generally, "xref-token" is again passed.

It should be in exact format, decode it if required, also remove , or ; or /. You can also use fiddler.

Answer 3

JMeter automatically treats HTTP Response Codes below 400 as successful, it doesn't perform any checks of response body. Most likely your Regular Expression Extractor failed, add a Debug Sampler and double check resulting variable value.

There could be also the following possible reasons:

• You might need to send CSRF token in encoded/escaped form so using i.e. __urlEncode() function will be required. Or vice versa.
• Application may expect the token in multiple locations, i.e. not only as a form parameter, but as an extra HTTP Header. In that case you will need to pass it via HTTP Header Manager

You might also want to try the new step-by-step debugger for JMeter to get to the bottom of the issue.