Why am I getting a 403 error when running Locust?

Question

I am using Locust (python) to load test on a Django web app. I keep getting a 403 error when I run my script.

Here is the code:

  from locust import HttpLocust, TaskSet

def index(l):
    l.client.get("/")
def login(l):
    l.client.post("/login/", {"username":"an@id.com", "password":"education")
def upload(l):
    l.client.get("/upload-image/")
def home(l):
  l.client.get("/home/")
def settings(l):
 l.client.get("/settings/")
def logout(l):
 l.client.get("/logout/")
class UserBehavior(TaskSet):
    tasks = {index:1, upload:1, home:1, settings:1, logout:1}

    def on_start(self):
        login(self)

class WebsiteUser(HttpLocust):
    task_set = UserBehavior
    min_wait=5000
    max_wait=9000

A status of 403 means forbidden, so your credentials are wrong. Either the user doesn't exist or you've forgotten to pass CSRF token to your view. — Henrik Andersson, Dec 03 '14 at 00:32
Just a note, having logout as a task means that Locust will pick that sometimes and then you will have an unauthorized client attempting to interact with your application, and you will get 401/403 errors again. — Zeroth, Oct 04 '17 at 16:16

score 18 · Answer 1 · answered Dec 23 '15 at 22:57

18

To expand on ZacDelagrange's answer, when you are using https, you must also set the Referer header, so in this example you could do

def on_start(self):
    """ Run on start for every Locust hatched """
    r = self.client.get('')
    self.client.headers['Referer'] = self.client.base_url
    self.client.post('/accounts/login/', 
        {'email': 'email', 'password': 'password',
         'csrfmiddlewaretoken': r.cookies['csrftoken']})

answered Dec 23 '15 at 22:57

TheAxeR

622
5
5

3

Thanks, I think the referer was the issue for me before I read your answer. – goetz May 23 '16 at 12:13

score 7 · Answer 2 · answered Jan 20 '15 at 21:30

Do a get on your root or login page, grab the csrf token from the response cookie, and post to your login url with the csrftoken. This should add the csrf token to the client's cookies and allow you to browse the page.

def on_start(self):
    """ Run on start for every Locust hatched """
    r = self.client.get('')
    self.client.post('/accounts/login/', 
        {'email': 'email', 'password': 'password',
         'csrfmiddlewaretoken': r.cookies['csrftoken']})

Why am I getting a 403 error when running Locust?

2 Answers2