如何对使用 ValidateAntiForgeryToken 的网站进行负载测试？
我想在一个对多个 HttpPost 使用 ValidateAntiForgeryToken 的网站上执行负载测试。但是，正如您所期望的，当我运行负载测试脚本时，我收到了许多 500 错误，因为 __RequestVerificationToken 要么是从早期请求复制的，要么是空白的。两者都失败了。
有没有什么方法可以加载我在 HttpPost 方法上使用 ValidateAntiForgeryToken 属性的测试站点？
我尝试使用 StresStimulus 和 SmartBear 的 LoadComplete 进行测试。
I would like to perform a load test on a site that uses ValidateAntiForgeryTokens on a number of HttpPosts. However, as you would expect, when I run my load test script, I receive a number of 500 errors because the __RequestVerificationToken is either copied from an earlier request or is blank. Both of which fail.
Are there any ways to load test sites where I am using the ValidateAntiForgeryToken attribute on my HttpPost methods?
I've tried using StresStimulus and also SmartBear's LoadComplete for my tests.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您使用的是 fiddler 和 http://stresstimulus.stimulustechnology.com/ （我没有使用过）我必须想象您可以先登录，然后使用该会话作为您的负载。 AntiForgeryTokens 不是一次性的，只要 cookie 存在用于您的身份验证信息以及在登录会话期间生成的防伪令牌，就应该没问题。
If you are using fiddler and http://stresstimulus.stimulustechnology.com/ (which I haven't used) I have to imagine you can first login, and then use that session as your load. The AntiForgeryTokens are NOT one time, and as long as the cookie is there for your auth info and an anti forgery token generated during that login session, it should be fine.
我对 StressStimulus 也有同样的问题。提交到站点的某些表单失败，因为运行记录的请求时未更新 __RequestVerificationToken。 {{自相关}} 在我的情况下不起作用。我使用正则表达式提取器来解决它。这是 链接到我在 StressStimulus 上的帖子
I had the same problem with StressStimulus. Some of the forms submitted to the site were failing because the __RequestVerificationToken are not updated when the recorded request is run. {{Auto-Correlation}} did not work in my case. I used regex extractor to solve it. Here's the link to my post on StressStimulus
如果没有看到您正在处理的场景的详细信息，就很难确定。但我们已经能够自动化许多此类动态字段以进行负载测试（我们唯一无法绕过的是那些需要人工输入的字段，即验证码）。一般来说，您需要找到 __RequestVerificationToken 字段的值来自哪里 - 无论是 cookie、javascript 计算、隐藏表单字段等。找到该字段后，您可以提取或计算该值作为负载测试场景并将其与请求一起发送。如果我没记错的话，我们之前已经解决了这个问题，没有做太多工作 - 如果您愿意让我们尝试解决这个问题，联系我们。一般来说，我们可以比您提到的任何一种解决方案更优雅地处理这些类型的问题。
Without seeing the details of the scenario you are working with, it is hard to say for sure. But we've been able to automate many of these types of dynamic fields for load testing purposes (the only ones we haven't been able to bypass are those that require human input, i.e. captchas). In general, you need to find where the value of the __RequestVerificationToken field came from - be it a cookie, a javascript calculation, a hidden form field, etc. Once you've located that, you can extract or calculate that value as part of the load test scenario and send it along with the request. If my memory serves, we've tackled this one before with out much work - if you'd like to give us a shot at the problem, contact us. In general, we can handle these types of problems much more gracefully than either of the solutions you mentioned.