JMeter无法正常录制：跨Tab跳转场景下的门户A登录交互问题

• Verify Browser Proxy Setup
  Ensure your browser uses JMeter's proxy server (default: localhost on port 8080). Disable system-wide proxies or VPNs that might interfere with traffic routing to JMeter.

• Install JMeter's Root CA Certificate
  PHP sites often use HTTPS, so your browser needs to trust JMeter's certificate to capture encrypted traffic:

  1. In JMeter, go to Options > Export CA Certificate and save the file.
  2. Install this certificate in your browser's trusted root certificate store (steps vary by browser, e.g., Chrome: Settings > Privacy and security > Security > Manage certificates).

• Add HTTP Cookie Manager
  PHP relies heavily on session cookies for authentication. Add an HTTP Cookie Manager to your test plan—it automatically handles session cookies sent by Portal A, ensuring login state persists across requests.

• Handle CSRF Tokens
  Most PHP login forms include a hidden CSRF token to prevent attacks. To capture and reuse it:

  1. Add a CSS Selector Extractor (or XPath Extractor) to the login page request. Use a selector like input[name="csrf_token"] (adjust the attribute name to match your site's actual token field) to extract the token value into a variable (e.g., csrf_token).
  2. In the login POST request, replace the hardcoded token value with ${csrf_token}.

• Capture All Required Login Parameters
  Use JMeter's View Results Tree listener to inspect the actual login request your browser sends. Ensure all form fields (username, password, CSRF token, and any other hidden fields like submit or form_id) are included in JMeter's POST request parameters.

• Adjust Multi-Domain Recording Settings
  To capture traffic for both Portal A and Site B:

  1. In the HTTP(S) Test Script Recorder, add both domains to the Include URLs field (e.g., .*portalA\.com.*, .*siteB\.com.*).
  2. Remove any exclude patterns that might block requests to either domain.

• Troubleshoot with Request/Response Inspection
  Record a simple navigation to Portal A and check the View Results Tree for errors:

  • A 403 Forbidden response usually means missing CSRF token or invalid cookies.
  • A 302 Redirect without proper cookie handling might indicate login failure due to session issues.

内容的提问来源于stack exchange，提问作者huihui