spring-security - Gatling 测试 CSRF Spring Security 通过 Web 表单阻止了我的帖子

问题描述

我想做一个 Gatling 测试并通过带有表单参数的 Post 发送一个表单，但我得到一个 403，因为我的场景是从 spring Security 生成的 CSRF 令牌：

 val sentHeaders = Map(
        "Content-Type" -> "application/x-www-form-urlencoded",
        "User-Agent" -> "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0",
        "Accept" -> "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
        "Accept-Language" -> "fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3",
        "Connection" -> "keep-alive")
    
  val rechercheAvanceeScn = scenario("RechercheAvanceeAgent").during(TestsPerfConfiguration.dureeTest, "RechercheAvanceeAgentDuration", true) {   
      // Phase1: Authentification
      exec(
      http("Authentification")
      .get("/authlogin?sid=1&app=999&code_teleservice=DELTA-T"))
      
      // Phase 2: Form Recherche avancée
      .exec(
      http("RechercheAvanceeForm")
      .get("/recherche/avancee/form")
      .check(status.is(200))
      )
      
      // Phase 3: Recherche Avancée par type de declaration et type de garantie
      .exec(
      http("RechercheAvanceeAgentPost")
      .post("/recherche/avancee/result")
      .headers(sentHeaders)
      .formParam("mrn.comparateur", "EGAL")
      .formParam("mrn.value", "")
      .formParam("typeDeclaration.value", "")
      .formParam("dateDebut.comparateur", "EGAL")
      .formParam("dateDebut.value", "")
      .formParam("dateDebut.valueMax", "")
      .formParam("dateLimitePresentationMarchandises.comparateur", "EGAL")
      .formParam("dateLimitePresentationMarchandises.value", "")
      .formParam("dateLimitePresentationMarchandises.valueMax", "")
      .formParam("modeTransmission.value", "TOUS")
      .formParam("typeProcedureDepart.value", "")
      .formParam("typeProcedureDestination.value", "")
      .formParam("dateFin.comparateur", "EGAL")
      .formParam("dateFin.value", "")
      .formParam("dateFin.valueMax", "")
      .formParam("dateDepotDeclaration.comparateur", "EGAL_HEURE_MINUTES")
      .formParam("dateDepotDeclaration.value", "")
      .formParam("heureDepotDeclaration.value", "00:00")
      .formParam("dateDepotDeclaration.valueMax", "")
      .formParam("heureDepotDeclaration.valueMax", "00:00")
      .formParam("donneesSureteSecurite.value", "")
      .formParam("paysExpedition.value", "")
      .formParam("nomenclatureMarchandises.comparateur", "EGAL")
      .formParam("nomenclatureMarchandises.value", "")
      .formParam("paysDestination.value", "")
      .formParam("valeurFactureTotale.comparateur", "EGAL")
      .formParam("valeurFactureTotale.value", "")
      .formParam("valeurFactureTotale.valueMax", "")
      .formParam("bureauDepart.value", "")
      .formParam("bureauDestination.value", "")
      .formParam("bureauPassage.value", "")
      .formParam("circuitBureauDepart.value", "")
      .formParam("resultatControlesDepart.value", "")
      .formParam("circuitBureauPassage.value", "")
      .formParam("resultatControlesPassage.value", "")
      .formParam("circuitBureauDestination.value", "")
      .formParam("resultatControlesDestination.value", "")
      .formParam("typeGarantie.value", "TYPE_1")
      .formParam("dateDebutGarantie.comparateur", "EGAL")
      .formParam("dateDebutGarantie.value", "")
      .formParam("dateDebutGarantie.valueMax", "")
      .formParam("montantDetteSusceptibleNaitre.comparateur", "EGAL")
      .formParam("montantDetteSusceptibleNaitre.value", "")
      .formParam("montantDetteSusceptibleNaitre.valueMax", "")
      .formParam("grn.comparateur", "EGAL")
      .formParam("grn.value", "")
      .formParam("dateFinGarantie.comparateur", "EGAL")
      .formParam("dateFinGarantie.value", "")
      .formParam("dateFinGarantie.valueMax", "")
      .formParam("_suiteNonLiberationService.booleanValue", "on")
      .formParam("_suiteControleGarantie.booleanValue", "on")
      .formParam("etatDeclaration.value", "VALIDEE_MRN")
      .formParam("result", "")
      .check(status.is(200))
      )
  }

错误是： ---- 错误 ----------------------------- --------------------------

status.find.is(200)，但实际找到 403 102 (100,0%)

在帖子的参数中，当我执行并从 Firefox 发送表单时，我得到了一个令牌_csrf：“832749f8-7fc2-4fe7-8572-dedd578d1f9f”，但我不知道如何在我的测试中获取这个生成的令牌没有403 错误。

令牌存储在参数中，并且令牌在带有 JSTL 标记的标头中实现：。

有人能帮帮我吗？

标签： spring-securitytokencsrfgatlingcsrf-protection

spring-security - Gatling 测试 CSRF Spring Security 通过 Web 表单阻止了我的帖子

问题描述

解决方案

推荐阅读