Alfresco cookie Alfresco-CSRF Token

[cco]

Hi all,

I am using JMeter (v2.9) to test performance of application based on Alfresco(v5.0.3).

I can not get cookie Alfresco-CSRF Token.

By viewing request in Firefox tools, Alfresco-CSRF Token is given in the Response Header in the request GET /share/page following the request POST /share/page/login.

We have in order :

1. request GET /share/page that sets cookies JSESSIONID; ROUTEECMID; ROUTESHAREID; ROUTESOLRID; CONTLB901

2. request POST /share/page/login that sets JSESSIONID; _alfTest; alfLogin; alfUsername3

3. request GET /share/page that uses in its header cookies : JSESSIONID; _alfTest; alfLogin; alfUsername3; ROUTEECMID; ROUTESHAREID; ROUTESOLRID; CONTLB901. And in its response header, there sould be possible to get Alfresco-CSRF Token.

But, despite sending all needed cookies in the request GET /share/page , there is no cookie Alfresco-CSRF received in the Response Header.

Thanks for your advices

[mehe]

Hi,

not sure if missed something in your description - the client, in your case jmeter, must have a mechanism to receive and store the cookies.  Is your jmeter cookie manager enabled and have set CookieManager.save.cookies=true?

Did you follow articles that describe jmeters use in the context of CSRF protection (i.e. How to Load Test CSRF-Protected Web Sites | BlazeMeter )?

or tried to just turn off or configure the Alfresco CSRF protection temporarily? Cross-Site Request Forgery (CSRF) filters | Alfresco Documentation 

[cco]

Hi Martin,

In Jmeter, Cookie Manager is used. But unfortunaly, no cookie CSRF was present in response header. So no parsing was possible.

The problem was that 3 servers ECM, SHARE and SolR sent your own header and i got JSESSIONID cookie instead of CSRF cookie.

It was resolved by changing apache configuration.

[afaust]

The GET on /share/page should redirect you with a 302 response to the actual starting page, normally the user dashboard. The GET for the user dashboard should then provide you with the CSRF token, as these are generated on each page rendition request.

[mehe]

Sorry bothering you with the basic stuff, but it's sometimes hard to see how deep the analysis of the problem went before  glad to hear you've got it working