0

I just started using Jmeter at my job and when recorded the script and try to play back i am getting this message for login

Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN

I am also getting response code 403.

Can somebody please help me?

Matthew Verstraete
  • 6,335
  • 22
  • 67
  • 123
Medmans1
  • 1
  • 1
  • Possible duplicate of [this](http://stackoverflow.com/questions/21128058/invalid-csrf-token-null-was-found-on-the-request-parameter-csrf-or-header) SO question. – Jeroen Heier Jan 27 '17 at 17:57

2 Answers2

1

It means that you need to correlate a dynamic value:

  • In the first request you get something called "CSRF token" either in response body or in response headers. This is a form of security enhancement to protect the application from CSRF attacks.
  • In order to be able to make next request you need to pass exactly the same value as you got in response to your first request (to confirm your origin). You need to extract it with a JMeter PostProcessor, convert it into a JMeter Variable and send it as a parameter _csrf or as X-CSRF-TOKEN request header using HTTP Header Manager

See How to Load Test CSRF-Protected Web Sites for more detailed explanation and example of CSRF protection bypassing in JMeter test script

Dmitri T
  • 159,985
  • 5
  • 83
  • 133
0

You can try adding a HTTP Cookie Manager, as csfr tokens are sometimes sent in the cookies. Regards

uru917
  • 91
  • 13