Settings when calling API using CSRF measures of Spring Security in JMeter

Thing you want to do

As the long title says. I made an API to call from a Vue.js application with Spring Boot, It was decided to load test the API. I use JMeter to create a scenario, but since I am using CSRF measures using CookieCsrfTokenRepository of Spring Security.

• Get the value of the XSRF-TOKEN cookie as a CSRF token
• Set as the X-XSRF-TOKEN header when calling an API using POST

That's why we needed to do that in the scenario.

Rough specifications of the API under test

Only the image looks like this.

environment

application

• Spring Boot 2.1.4

tool

• Apache JMeter 5.1.1
• Settings are made by starting the GUI.

JMeter settings

Get the value of XSRF-TOKEN

The / login response will contain the XSRF-TOKEN cookie, so we will extract it. For the time being, looking at the response of / login with DevTools, it looks like this.

Setting

Calls to / login are defined in the HTTP Request sampler. (Details omitted) After running this sampler, use regular expression extraction to get a CSRF token.

procedure

1. Select the HTTP Request sampler in / login and right-click
2. Select ʻADD → Post Processors→Regular Expression Extractor`
3. Set as follows (Name and Comments are appropriate)

• Extract from Response Headers
• Since it is extracted from the header, it is necessary to write the regular expression in the format confirmed by DevTools earlier, in short, the format including "Set-Cookie:".

Is that the point? In subsequent scenarios, you can specify $ {xsrf_token} to resolve the extracted value from a variable.

Set the X-XSRF-TOKEN header

Since / orders is subject to CSRF checking, it is necessary to set the X-XSRF-TOKEN header at the time of calling.

Setting

Calls to / orders are defined in the HTTP Request sampler. (Details omitted) When running this sampler, use the HTTP Header Manager to set the X-XSRF-TOKEN header.

procedure

1. Select the HTTP Request sampler in / orders and right-click
2. Select ʻADD → Config Element→HTTP Header Manager`
3. Set as follows (Name and Comments are appropriate, content-type is set because it is necessary in this API-specific specification)

The $ {xsrf_token} obtained earlier is set as the X-XSRF-TOKEN header.

Summary

With the above settings, you can pass the CSRF measures. If you're new to JMeter, you can't immediately think of such a small application. I thought it would be annoying (it's my unfamiliar experience), so I wrote it down.

Reference page

I referred to the following. Thank you very much.

https://www.blazemeter.com/blog/how-load-test-csrf-protected-web-sites