JSON web token generator for JMeter

Question

I'm trying to compare JWT value returned by an API call to an expected valid value in JMeter. For this, I need to generate the expected value in a pre-processor (either the BSF pre-processor or the Bean shell pre-processor) and then compare it to the extracted from the call response value. Has anyone created anything similar before? I currently use http://jwt.io/ to manually generate the expected values, but would like to dynamically generate these values in JMeter.

Answer 1

Unfortunately there is at the moment no out-of-box solution for processing JWT-signed requests in JMeter.

Looks like you have at least the following options:

1. Try to use gatling instead of JMeter. Gatling has already implemented extension for this payload - gatling-jwt - but seems that it supports currently only GET requests.

2. Possibly you can try to extend standard HTTP Request Sampler or custom REST Sampler with JWT signing using any java implementation of JWT - like it's done in OAuth Sampler plugin for OAuth payload.
   But it may appear quite complex way which requires a bit of development experience as well as will be not error-prone - inaccurate implementation may cause performance degradation and affect your test-results.

3. Approach with Pre- and Post-processors for JWT-signing and response verification you've mentioned in your question seems to be reasonable compromise.
   When I've stuck on the same issue my first and quite successful approach with Pre- and PostProcessors usage too.
   Several points to note:

   • use JSR233 (both PreProcessor and PostProcessor) + Groovy instead of Beanshell for performance reasons (for details you can look into this article);
   • select any stable java implementation of JWT from list of available;
     I've used jjwt and find it good enough as well simple to use;
   • perform request body JWT-signing in PreProcessor, store signed body into variable, send it along with HTTP request as Body Data and decode response in PostProcessor;

     HTTP Request // your http call
     Body Data = ${jwtSignedBody} // variable with request body already signed in pre-processor
         JSR233 PreProcessor // sign here your body data and put into variable
         JSR233 PostProcessor // decode JWT-signed response
     

     • request JWT signing
     • response decoding
   • it may be extremely useful for debugging and further processing to update in PostProcessor response body with decoded response like in the script above.