I am doing performance testing. I have a URL abc.com it redirects to http://github.com for login. Because abc.com is registered in Github. What will be the approach to login into the application with Jmeter
It's called OAuth and you need to implement the required authorization flow, most probably Authorization Code Grant, however it depends on how your "abc.com" is exactly integrated with Github.
All the information on possible options and flows is listed on Github website so you either need to ask around what exact flow is being used or inspect the traffic from your browser using your browser developer tools or external sniffer tool like Fiddler or https://www.wireshark.org/
Actually it's only matter of passing correct parameters to Github https://github.com/login/oauth/authorize and https://github.com/login/oauth/access_token endpoints and correlating the dynamic values using suitable JMeter Post-Processors.
Related
In my Controller, which is build with using spring-boot, I've enable CORS only for my server and localhost whit this annotation:
#CrossOrigin(origins = {"http://localhost:8080", "https://www.somepage.com"}, maxAge = 3600)
This is working fine. But now I'm not sure, if it's also needed, to add basic authentication for the REST API. As far as I understood, the only call the REST API is accepting now, is my own server and localhost, and that's why, I think it's not needed. But I was not able to figure out, if this is a bad practice or not.
Do You recommend to use basic auth too for the REST API even when CORS is enabled?
No.
The Same Origin Policy is a feature built into browsers that prevents an attacker's JavaScript running on the attacker's website from reading the response to an HTTP request from the victim's browser to the targetted website.
This stops the attacker from stealing data from the targetted website using the credentials belonging to the victim.
(To some degree. There are other kinds of attacks.)
CORS is a tool that relaxes this rule so that when you to allow another site to access that data (either using the user's credentials or because it is just public data), it can.
Note that I said "a feature built into browsers". It isn't built into other tools.
An attacker can still make HTTP requests with their code, or tools like Postman and curl, or their own web browser.
Neither the Same Origin Policy nor CORS are substitutes for authentication and authorization.
CORS is a mechanism implemented in browsers and it will not prevent me to access your API with curl. Therefore, secure your API if you need it to stay secure.
My tester has integrated Burp tool with firefox, where he is running our project on same browser. He is saving each and every request of application in Burp tool and then login with another user to post request data of first user, or he logout of system and only post request data where he is able to save that data properly. Can anybody please answer that how I can stop laravel to save data on Burp or any other tool like this
This is an integral part of testing. You should not be trying to find ways to deceive testing tools. You should be implementing good security in your application.
I need to perform load test on one of my site , which has google sign In button , how do I logged in one time and then request for specific page 10 times .
Recording controller also does not did the work , is there something other way around.
Thanks
It looks like your site is using OAuth so record and replay and even correlation won't help as it is too specific.
OAuth authentication is all about obtaining a token (see User Authentication with OAuth 2.0) and passing it along with your credentials via HTTP Header Manager.
There are several ways of obatining an OAuth token, see How to Run Performance Tests on OAuth Secured Apps with JMeter to learn more.
I am trying to perform load testing using JMeter on my project's web service (search web service for instance), the problem I am facing is that I am getting {"Message":"Authorization has been denied for this request."} in "Response data" tab in JMeter
This same message I also get when I try to paste the same query string (which I am using in JMeter as Path) in browser new tab without logging in first,, but if I login on my project first and then try to paste the query string in browser's new tab then it works fine.
Now the actual problem that I am facing in JMeter is that I am unable to log in to the system using "HTTP Header Manager"
I tried by adding Basic authentication in "HTTP Header Manager" but it didn't worked, then my developer told me that he is using "ASP Membership" authentication instead of Basic authentication,, now I am not sure how to use this type of authentication in JMeter.
I think I have explained my problem in detail here, can any one please help me in this as I am really stuck into it.
Thanks in advance
You need to add a cookie-manager to your Thread Group. This will preserve the cookies ( hence sessions) between requests. Next add a http request which will do a POST of your login form then another HTTP Request with your actual request. This way you are imitating the steps you do on your browser - that is - login followed by request.
Looking into ASP.NET Forms Authentication Overview article:
Forms authentication lets you authenticate users by using your own code and then maintain an authentication token in a cookie or in the page URL.
So depending on implenentation of ASP.NET Forms on server side you can use one of the following test elements:
HTTP Cookie Manager
HTTP URL Re-writing Modifier
Also you may need to perform the correlation of the mandatory dynamic parameters such as VIEWSTATE or EVENTVALIDATION. See ASP.NET Login Testing with JMeter guide for detailed explanation and walkthrough.
I am starting a new project where we are planing to build a restful back end and an AJAX font end. I am approaching the problem by focusing on Identifying all the resources that I have and what the various HTTP verbs will do them, their URI and the JSON representations of those resources.
I am looking for the best design for securing the backend. Here is the list of designs I have considered. I am looking for alternative designs not listed below, and pros, cons recommendations. The system will be implemented with Spring 3.0 and possibly Spring Security 3.0, SSL will be used for many parts of the system but not for all of them, so some requests may come on SSL and some might not.
Option 1: Use the HTTP session
Show a standard login screen, create a server side session and let tomcat send back a jsessionid cookie and have the ajax client include the JSESSIONID cookie on every XHR request. This options just feels like it's the wrong approach for the following reasons.
The connection becomes statefull which is against the rules of REST
I want to be able to split the bakcend into multiple seperate WAR files which means i could have multiple HTTP sessions on the backend, if that is the case then this approach does not work. While I don't need the ability to split the backend into multiple apps today, I would prefer a design that allows for that possibility.
Option 2: Find an open source Java based security library that does this
Other than Spring security I have not found any other Java libraries, any recommendations are highly appreciated.
Option 3: Try to use an existing protocol like OAuth
In my very brief look at OAuth it seems that it is designed for authentication across sites where each site has it's own user database. In this system i want a global user database shared across all the backend ajax services.
Option 4: Use SAML and Shiboleth
This options seems over kill and hugely complex to setup and maintain.
Option 5: Send the username and password with every request
This requires that user sends their username and password with every request, which means that the front end AJAX app must store the username and password as a JavaScript object and if the user navigates away from the page then back the username/password combo will be gone and the user might be forced to log in again. I don't want the front end to try and put the username and password into cookie as that would comprise security.
Option 6: Implement my own authentication / Authorization protocol
Create a REST service that users can present their username/password combination to and then get back and security token, which they must send back to the service with every request. The security token would be digitally signed by the service and would have an expiry time. The token would be only good for most operations high security operations would require a new login screen as port of confirming the operation.
Problem with this approach is I have to invent yet another security protocol which seems like a total waste of time.
I am sure I am not the only person up against this problem, I hope the stack overflow community can point to some options and tools that I have not found yet.
Take a look at Apache Shiro. It is an authentication system that has a session management feature that can be used to share sessions across applications. This may be the easiest thing to do.
Or you could use Spring Security (or Shiro) with a Remember Me cookie that is shared across the webapps (as long as they are in the same HTTP domain). The remember me cookie would be analogous to your token in option 6. You can set the expiration on the cookie that so it is short lived like a session cookie or long lived like a regular remember me.
You might also want to take a look at Jasig CAS - Single Sign-On for the Web. It has a REST API and a protocol (Proxy Tickets) that allows services to proxy user AuthN to backend services like you described in option 6. http://www.jasig.org/cas
Briefly...the application that serves up the AJAX client is protected with Spring Security (supports CAS out of the box) and gets a Proxy Granting Ticket that you embed in the AJAX client. The AJAX client uses the PGT to get Proxy Tickets for your REST services...protected with Spring Security too. The REST services get an authenticated userId without every touching primary credentials.
Alternative, you could keep the PGT on the server and use AJAX calls to retrieve Proxy Tickets that are then used by the AJAX client to call you REST services.
As I understood you are going to secure a rest application, to preface you must know that a security provider consisd of three concepts (3A):
-Authentication
-Authorization
-Auditing
to implement these three together you must provide bunch of tools such as :
-SSO provider
-Session Store
-Open Id pattern
-user credentials integration
....
I have used ACL(Spring ACL) to provide authorization services and oauth2 for authentication.
there is one channel to connect these two together and its scopes(oauth2 scopes) but the problem is scopes are not flexible(pure strings) enough to implement authorization modules such as role_voter, cache_strategy, black_list or,Role_base strategy, exceptional permissions, white_list... (but you can use #EnableGlobalMethodSecurity)
In my case I used authorization server as a resource for oauth2 authentication server(take a look at http://projects.spring.io/spring-security-oauth/docs/oauth2.html), then I considered two spots to check authorization, the first I issued ACL to front-end and forced programmer to design her page dynamically up to ACL concept, the second is in back-end on service layer(BLL) using Aspect when one rest is going to be called. I sent the service key as an actee to check if current user has enough access control to do that. and for auditing you must monitor all requests I mean you must use an listener in your gateway or broker...