I am trying to do a performance test for an application in which when the user hits the login URL with Credentials, it redirects to another URL and proceeds so on.
I checked the Csrf token supplied to the Url and it is correct. I also checked the user credentials supplied in header data and it is also correct. I even checked for session id and it is static till the redirection happens. I unable to extract a token for active session since the redirection happens with error. can someone help with what is wrong in this scenarios.
Tried with Follow redirects option and getting the below error.. when tried with automatically redirect no error found but invalid session response was shown.
Request:
enter image description here
Response:
enter image description here
As per 307 Temporary Redirect status description:
HTTP 307 Temporary Redirect redirect status response code indicates that the resource requested has been temporarily moved to the URL given by the Location headers.
JMeter should follow the redirect and make the request to the target URL, if it doesn't - play with Redirect automatically and Follow redirects boxes:
In any case you should be able to extract the target URL from the Location header using i.e. Regular Expression Extractor and put the resulting URL into "Path" section of the next HTTP Request sampler
Also JMeter should treat HTTP Status 307 as success (as well as any other HTTP status code below 400) so maybe you have an Assertion somewhere which artificially fails the Sampler based on the status code (i.e. checking if it's equal to 200)
Why is this second request happening (Request2-1) here and how to solve it.
Your request is redirected and there is not permission to access the resource.
The HTTP 403 Forbidden client error status response code indicates that the server understands the request but refuses to authorize it.
Please check the request details in the view result tree by clicking Request->Request Body and Request->Request Headers
You need to ensure that the request is permitted.
Most probably the resources, you're trying to access require authentication and you're not supplying valid authentication context.
If you do HTTP Status Code 403 means that the user is not allowed to access the endpoint.
See How to use JMeter for Login Authentication article for more information on example bypassing login challenge in JMeter tests.
If "Follow Redirects" is selected in HTTP Request, it will follow the redirects and groups each redirect under the original request as in the image you posted.
Some APIs can redirect, this is normal. Response failure is caused by the request content sent. Check the parameters and body values you sent.
I am using Authenticator doing Oauth2 authentication. The return url is something like myapp://landing. I got following errors, The URL can not be shown and Frame load interrupted. It seems I can not suppress this error. I got the correct token from the service. I just want to know if there is a way I can suppress them.
I'm following the instructions given on this page:
https://stocktwits.com/developers/docs/authentication
I've managed to get the client id, client secret and the code without any problems (up to step 4). However, when trying to exchange these for an access token, I'm getting a blank page.
The instructions specify that the return is a json format response - maybe there are some browser settings that I need to check to allow this?
thanks in advance for any pointers.
Judging by the title of this post "returning a blank page" it sounds like you are trying to make this request through the browser. The page you referenced says that the request must be a POST request and browsers cannot make POST requests.
On the step you're stuck on (step 5) there is a link that says "View the token call" that links here https://stocktwits.com/developers/docs/api#oauth-token-docs which shows how to make this POST request using curl.
A similar question is posted here: What's an appropriate HTTP status code to return by a REST API service for a validation failure?
The answer in the thread above states that "For instance if the URI is supposed to have an ISO-8601 date and you find that it's in the wrong format or refers to February 31st, then you would return an HTTP 400. Ditto if you expect well-formed XML in an entity body and it fails to parse."
However, what happens if the user submitted correctly formatted data? By this I mean, the user submitted a plain alphabetical string / text for the username and password (which is perfectly valid for my application). The only issue is that the password did not match with the username. In this case, 400 will be incorrect because it is perfectly valid syntax and well-formed.
A 401 would be incorrect (as suggested here: Which HTTP status code to say username or password were incorrect?) because the user is not trying to access any page, he is simply trying to login and entered data which does not match.
If you look back at the first post I linked to, the second answer states that 422 is the correct response (and it looks correct to me), however, I am using Django Rest Framework and 422 is not part of the status codes (a list of the status codes which are part of DRF can be found here: http://www.django-rest-framework.org/api-guide/status-codes/#client-error-4xx)
404 also doesn't look right because the data is successfully accepted and not refused.
With that said, what is the real correct response which should be used?
If you are strictly using the HTTP authentication framework provided by RFC 7235 for your REST API, the correct HTTP code would actually be 401. From the RFC:
The 401 (Unauthorized) status code indicates that the request has not been applied because it lacks valid authentication credentials for the target resource. The server generating a 401 response MUST send a WWW-Authenticate header field (Section 4.1) containing at least one challenge applicable to the target resource.
If the request included authentication credentials, then the 401 response indicates that authorization has been refused for those credentials. The user agent MAY repeat the request with a new or replaced Authorization header field (Section 4.2).
Your REST API should employ an authentication scheme of some sort in order to return a valid 401 response to your client.
Another pertinent section from RFC 7235, page 4:
Upon receipt of a request for a protected resource that omits
credentials, contains invalid credentials (e.g., a bad password) or
partial credentials (e.g., when the authentication scheme requires
more than one round trip), an origin server SHOULD send a 401
(Unauthorized) response that contains a WWW-Authenticate header field
with at least one (possibly new) challenge applicable to the
requested resource.
A higher-level response, such as a rendered login page for a visual user (redirected from a protected resource via 302), would be better served with the 200 status code (per #KernelDeimos' answer, for example). Since login pages are typically their own resource (e.g. /login?redirect=original-resource), the unauthenticated user is still authorized to see this page, even if they provide an incorrect username/password. Then, you redirect the authenticated user back to the resource, at which point would show 200 if allowed, or 403 if the user is forbidden to view the resource.
The area where 401 could come into play with a visual login page is a front-end library that leverages the REST API using XHR requests, then relay the 401 response from the REST API back into a meaningful format on the login page.
If login is handled at a higher-level (ex: sending a POST to the server with a username and password), use the appropriate status code in 2xx for a successfully handled login request with the wrong password. If using the HTTP authentication framework provided by RFC 7235, send 401 (see answer by #sjagr for further detail).
Below the line is the rest of my original answer, which explains my train of thought. Also note the thread on sjagr's answer which includes a debate which improved both our answers and a comment from Julian Reschke (one of the RFC's authors).
Before asking "what is the correct HTTP status code", it's important to consider this question: "Should success or failure of login be reflected in the HTTP status code of the response?"
In #sjagr's answer the first part of this section is highlighted. I'm going to highlight the second part and explain why:
If the request included authentication credentials, then the 401 response indicates that authorization has been refused for those credentials. The user agent MAY repeat the request with a new or replaced Authorization header field (Section 4.2).
This refers to an Authorization header, rather than a request body containing login credentials. The phrasing of the first part, unfortunately, could be misinterpreted to refer to a request body containing login information. This ambiguity can be resolved by considering separation of concerns; (https://en.wikipedia.org/wiki/Separation_of_concerns) the server's response header should not depend on the differences of two valid request bodies, with the exception of when it causes an internal server error, otherwise the concerns of data transfer and appliction login begin to creep into each other.
I would use HTTP response 2xx for a valid login request, where the client has permission to attempt a login, that is handled successfully with a response indicating success or failure.
I also like the way #spectras expressed this in the comments:
Attempting to express an application-level error in a transport-level status code is a design mistake.
401 - Unauthorized
403 - Forbidden
http://www.buggybread.com/2012/11/http-error-codes-401-access-denied-403.html
If you try to log into a Google account with the wrong password, it will return a 200 response containing data that indicates the password was incorrect. For that reason, I just use a 200.
At the end of the day, which status code you use is purely a semantic issue and isn't going to change the functionality of your application. What really matters is that your application displays the correct information to the user.
I think what causes all the confusion is that there are two entities that need to be authenticated. One is the client (front-end app) needs to authenticate itself, that its authorized to make a login request for the user, and then the user needs to authenticate itself with his username/password.
The status code should only be related to the client making the request, not the user.
From https://developer.mozilla.org/en-US/docs/Web/HTTP/Status
HTTP response status codes indicate whether a specific HTTP request has been successfully completed.
200 is correct:
Given that you have a front-end application that talks to the backend, the appropriate respond code should be 200 and the response body should contain the information if password matches or not, but that result has no impact on the status code, because the request itself was authorized and successfully parsed.
401 is wrong:
Assume your front-end authenticates with a token for example, then the response code 401 would mean the front-end token is invalid, not the password of the user inside that request.
403 is wrong: Assume your front-end authenticates with a token for example, then the response code 403 would mean the token is vaild, but that token does not have the access right to ask if password/username match.