{"id":45,"date":"2015-07-17T10:50:43","date_gmt":"2015-07-17T10:50:43","guid":{"rendered":"http:\/\/loadfocus.com\/blog\/tech\/?p=45"},"modified":"2019-04-26T08:42:07","modified_gmt":"2019-04-26T08:42:07","slug":"using-a-csv-file-for-login-credentials-and-extracting-the-token-from-the-response-when-running-jmeter-tests","status":"publish","type":"post","link":"https:\/\/loadfocus.com\/blog\/tech\/2015\/07\/using-a-csv-file-for-login-credentials-and-extracting-the-token-from-the-response-when-running-jmeter-tests","title":{"rendered":"Using a CSV file for login credentials and extracting the token from the response when running JMeter tests"},"content":{"rendered":"<span class=\"span-reading-time rt-reading-time\" style=\"display: block;\"><span class=\"rt-label rt-prefix\"><\/span> <span class=\"rt-time\"> 3<\/span> <span class=\"rt-label rt-postfix\">minutes read<\/span><\/span><p class=\"lead\"><!-- pn-tldr --><\/p>\n<h2>Key takeaways<\/h2>\n<ul>\n<li>A CSV of credentials gives each virtual user a distinct login, which is what makes auth load realistic.<\/li>\n<li>Extract the token with a post-processor and store it in a variable for later requests.<\/li>\n<li>Use test accounts only, since tokens and credentials end up in result files.<\/li>\n<\/ul>\n<p><!-- \/pn-tldr --><\/p>\n<h4>In order to extract data from the response&nbsp;with JMeter you need to:<\/h4>\n<ul>\n<li>have the CSV file with the credentials in a format similar to the one below<\/li>\n<li>have JMeter installed<\/li>\n<li>JMeterPlugins-Extras installed &#8211; installing the plugins is detailed on the following post<\/li>\n<li>JMeterPlugins-ExtrasLibs installed &#8211; installing the plugins is described on the following post<\/li>\n<\/ul>\n<p><span style=\"font-size: large;\"><b>Four steps from the CSV file to being able to login and getting the token from the response<\/b><\/span><\/p>\n<p><strong>1. The CSV file with the credentials<\/strong><\/p>\n<p>The CSV file that we will use as the source(username and password) for the login process needs to be in a format similar to the following:<\/p>\n<pre class=\"lang-java\"><code class=\"lang-java\">\nuser1,password1\nuser2,password2\nuser3,password3\nuser4,password4\nuser5,password5\n<\/code><\/pre>\n<p>2. Create a new thread group and add the CSV Data Set Config as detailed in the images below<\/p>\n<p><a href=\"http:\/\/loadfocus.com\/blog\/tech\/wp-content\/uploads\/sites\/2\/2015\/07\/using_csv_for-credentials1.png\"><img loading=\"lazy\" decoding=\"async\" width=\"3356\" height=\"2050\" src=\"http:\/\/loadfocus.com\/blog\/tech\/wp-content\/uploads\/sites\/2\/2015\/07\/using_csv_for-credentials1.png\" alt=\"using_csv_for credentials1\" class=\"aligncenter size-full wp-image-49\"><\/a><\/p>\n<p><a href=\"http:\/\/loadfocus.com\/blog\/tech\/wp-content\/uploads\/sites\/2\/2015\/07\/using_csv_for-credentials2.png\"><img loading=\"lazy\" decoding=\"async\" width=\"3356\" height=\"2054\" src=\"http:\/\/loadfocus.com\/blog\/tech\/wp-content\/uploads\/sites\/2\/2015\/07\/using_csv_for-credentials2.png\" alt=\"using_csv_for credentials2\" class=\"aligncenter size-medium wp-image-50\"><\/a><\/p>\n<p>3. Add the JSON Path Extractor that we will use to extract the token from the response as in our case the response is in the JSON format like the following:<\/p>\n<pre class=\"lang-java\"><code class=\"lang-java\">\n{\n\n\"data\": {\n\n\"id\": \"a964a723ecfb61ba5e54d8cd22420f20\",\n\n},\n\n\"status\": {\n\n\"httpStatus\": 200,\n\n\"success\": true\n\n}\n\n}\n<\/code><\/pre>\n<p><a href=\"http:\/\/loadfocus.com\/blog\/tech\/wp-content\/uploads\/sites\/2\/2015\/07\/using_csv_for-credentials3.png\"><img loading=\"lazy\" decoding=\"async\" width=\"3358\" height=\"2050\" src=\"http:\/\/loadfocus.com\/blog\/tech\/wp-content\/uploads\/sites\/2\/2015\/07\/using_csv_for-credentials3.png\" alt=\"using_csv_for credentials3\" class=\"aligncenter size-medium wp-image-51\"><\/a><br \/>\n[emaillocker]<br \/>\n<a href=\"http:\/\/loadfocus.com\/blog\/tech\/wp-content\/uploads\/sites\/2\/2015\/07\/using_csv_for-credentials4.png\"><img loading=\"lazy\" decoding=\"async\" width=\"3356\" height=\"2054\" src=\"http:\/\/loadfocus.com\/blog\/tech\/wp-content\/uploads\/sites\/2\/2015\/07\/using_csv_for-credentials4.png\" alt=\"using_csv_for credentials4\" class=\"aligncenter size-medium wp-image-52\"><\/a><\/p>\n<p>The expression that we use in the JSON Path Extractor is $.data.id as this refers to the id field in the data object. You need to adjust this to match your JSON format from the response.<\/p>\n<p>4. Create the call that will access the area in the web application for which the user needs to be logged in and add the HTTP Header Manager that will use the token as a X-CSRF-Token like in the image below<\/p>\n<p><a href=\"http:\/\/loadfocus.com\/blog\/tech\/wp-content\/uploads\/sites\/2\/2015\/07\/using_csv_for-credentials5.png\"><img loading=\"lazy\" decoding=\"async\" width=\"3360\" height=\"2048\" src=\"http:\/\/loadfocus.com\/blog\/tech\/wp-content\/uploads\/sites\/2\/2015\/07\/using_csv_for-credentials5.png\" alt=\"using_csv_for credentials5\" class=\"aligncenter size-medium wp-image-53\"><\/a><\/p>\n<p><a href=\"http:\/\/loadfocus.com\/blog\/tech\/wp-content\/uploads\/sites\/2\/2015\/07\/using_csv_for-credentials6.png\"><img loading=\"lazy\" decoding=\"async\" width=\"3354\" height=\"2052\" src=\"http:\/\/loadfocus.com\/blog\/tech\/wp-content\/uploads\/sites\/2\/2015\/07\/using_csv_for-credentials6.png\" alt=\"using_csv_for credentials6\" class=\"aligncenter size-medium wp-image-54\"><\/a><\/p>\n<p>You are all done, now you can access any part of your web application that needs the user to be logged in using the same process that we used at step 4.<\/p>\n<p>Enjoy.<\/p>\n<p>&nbsp;<br \/>\n[\/emaillocker]<!-- pn-faq --><\/p>\n<h2>Frequently Asked Questions<\/h2>\n<h3>Why give each virtual user its own login?<\/h3>\n<p>Because a single shared account does not behave like real traffic. Sessions, rate limits and per user caches all serve one login far more cheaply than they serve a thousand, so the test understates the load.<\/p>\n<h3>How do I get the token out of the login response?<\/h3>\n<p>With a post processor on the login sampler, such as the JSON Path Extractor for a JSON body. It writes the token into a variable that later requests reference with the ${name} syntax.<\/p>\n<h3>Is it safe to put real credentials in the CSV?<\/h3>\n<p>No. Use dedicated test accounts. The CSV sits in the test plan and the values end up in result files and logs, which are shared and archived far more widely than a password should be.<\/p>\n<p><!-- \/pn-faq --><!-- pn-related-reading --><\/p>\n<h2>Related reading<\/h2>\n<ul>\n<li><a href=\"https:\/\/loadfocus.com\/blog\/2025\/05\/using-csv-data-in-jmeter-tests\">Using CSV Data in JMeter Tests<\/a><\/li>\n<li><a href=\"https:\/\/loadfocus.com\/blog\/2021\/12\/how-to-use-csv-data-set-to-configure-jmeter-tests\">How to Use CSV Data Set to Configure JMeter Tests<\/a><\/li>\n<li><a href=\"https:\/\/loadfocus.com\/blog\/2022\/01\/how-to-test-oauth-secured-apis-apps-using-jmeter\">How to Test OAuth Secured APIs and Apps using JMeter<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p><span class=\"span-reading-time rt-reading-time\" style=\"display: block;\"><span class=\"rt-label rt-prefix\"><\/span> <span class=\"rt-time\"> 3<\/span> <span class=\"rt-label rt-postfix\">minutes read<\/span><\/span>Key takeaways A CSV of credentials gives each virtual user a distinct login, which is what makes auth load realistic. Extract the token with a post-processor and store it in a variable for later requests. Use test accounts only, since tokens and credentials end up in result files. In order to extract data from the&#8230;  <a href=\"https:\/\/loadfocus.com\/blog\/tech\/2015\/07\/using-a-csv-file-for-login-credentials-and-extracting-the-token-from-the-response-when-running-jmeter-tests\" class=\"more-link\" title=\"Read Using a CSV file for login credentials and extracting the token from the response when running JMeter tests\">Read more &raquo;<\/a><\/p>\n","protected":false},"author":1,"featured_media":509,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17],"tags":[],"class_list":["post-45","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-apache-jmeter"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/loadfocus.com\/blog\/tech\/wp-json\/wp\/v2\/posts\/45","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/loadfocus.com\/blog\/tech\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/loadfocus.com\/blog\/tech\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/loadfocus.com\/blog\/tech\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/loadfocus.com\/blog\/tech\/wp-json\/wp\/v2\/comments?post=45"}],"version-history":[{"count":7,"href":"https:\/\/loadfocus.com\/blog\/tech\/wp-json\/wp\/v2\/posts\/45\/revisions"}],"predecessor-version":[{"id":322,"href":"https:\/\/loadfocus.com\/blog\/tech\/wp-json\/wp\/v2\/posts\/45\/revisions\/322"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/loadfocus.com\/blog\/tech\/wp-json\/wp\/v2\/media\/509"}],"wp:attachment":[{"href":"https:\/\/loadfocus.com\/blog\/tech\/wp-json\/wp\/v2\/media?parent=45"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/loadfocus.com\/blog\/tech\/wp-json\/wp\/v2\/categories?post=45"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/loadfocus.com\/blog\/tech\/wp-json\/wp\/v2\/tags?post=45"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}