Key takeaways
- A CSV of credentials gives each virtual user a distinct login, which is what makes auth load realistic.
- Extract the token with a post-processor and store it in a variable for later requests.
- Use test accounts only, since tokens and credentials end up in result files.
In order to extract data from the response with JMeter you need to:
- have the CSV file with the credentials in a format similar to the one below
- have JMeter installed
- JMeterPlugins-Extras installed – installing the plugins is detailed on the following post
- JMeterPlugins-ExtrasLibs installed – installing the plugins is described on the following post
Four steps from the CSV file to being able to login and getting the token from the response
1. The CSV file with the credentials
The CSV file that we will use as the source(username and password) for the login process needs to be in a format similar to the following:
user1,password1
user2,password2
user3,password3
user4,password4
user5,password52. Create a new thread group and add the CSV Data Set Config as detailed in the images below
3. Add the JSON Path Extractor that we will use to extract the token from the response as in our case the response is in the JSON format like the following:
{
"data": {
"id": "a964a723ecfb61ba5e54d8cd22420f20",
},
"status": {
"httpStatus": 200,
"success": true
}
}
[emaillocker]
The expression that we use in the JSON Path Extractor is $.data.id as this refers to the id field in the data object. You need to adjust this to match your JSON format from the response.
4. Create the call that will access the area in the web application for which the user needs to be logged in and add the HTTP Header Manager that will use the token as a X-CSRF-Token like in the image below
You are all done, now you can access any part of your web application that needs the user to be logged in using the same process that we used at step 4.
Enjoy.
[/emaillocker]
Frequently Asked Questions
Why give each virtual user its own login?
Because a single shared account does not behave like real traffic. Sessions, rate limits and per user caches all serve one login far more cheaply than they serve a thousand, so the test understates the load.
How do I get the token out of the login response?
With a post processor on the login sampler, such as the JSON Path Extractor for a JSON body. It writes the token into a variable that later requests reference with the ${name} syntax.
Is it safe to put real credentials in the CSV?
No. Use dedicated test accounts. The CSV sits in the test plan and the values end up in result files and logs, which are shared and archived far more widely than a password should be.
