Pega application login JMeter script fails with 403 Forbidden error

General
, , , , ,
1

I’m working on performance testing a Pega application using JMeter. The JMeter script fails at login (Non SSO) at page /prweb/PRServlet/app/il-cc/********/!STANDARD with Error 403 Forbidden. I have captured dynamic values pzHarnessID and pzCTkn in script and using them. I see one more dynamic value pzBFP in header which I’m not able to capture as it seems to be generated by client side javascript. I suspect this is the one causing the request to fail but I might be wrong too. Has anyone come across similar issue handling pzBFP or any other work around you would suggest? Appreciate any help on this

Thanks

John

2

@JohnK17232555 :warning: Below is a GenAI-powered tool. All generated answers require validation against the provided references.

The issue you are facing with the 403 Forbidden error during performance testing using JMeter could be related to the CSRF token and fingerprint generation logic. In Pega Platform 8.4.3, a similar issue was resolved by adding both CSRF token and fingerprint generation logic to the pzBulkProcessingList. This might be relevant to your situation as the pzBFP value seems to be a client-side generated token that is required for the request to be authenticated properly. You might need to ensure that all necessary tokens, including CSRF and fingerprint tokens, are correctly captured and included in your JMeter script to avoid the 403 error.

Pega Platform 8.4.3 Patch Resolved Issues

To resolve the 403 Forbidden error during login in your JMeter script, try the following steps:

  1. Use the Netscape cookie policy in the HTTP cookie manager.
  2. Switch to the JVM HTTP implementation (HTTP request defaults → Advanced → Implementation: Java) instead of the standard Apache HttpComponents HttpClient 4.x.
  3. Ensure you are correctly extracting and using the pzTransactionId to maintain state between pages.
  4. For the pzBFP value, you might need to simulate the client-side JavaScript that generates it or find a way to capture it dynamically.
    These steps should help you address the issue and successfully log in using JMeter.

Performance Testing