You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@jmeter.apache.org by black gaff <jo...@gmail.com> on 2010/10/05 20:15:42 UTC
How to mask/encrypt values sent as an HTTP request parameter
In short, does anyone know of a workaround to mask/encrypt values sent as an
HTTP request parameter?
My company has a rule that user name/passwords cannot be stored in scripts.
In my JMeter scripts, I've gotten around this by passing the user
name/password through the command line and storing them as properties to be
retrieved later.
The user name and password are passed in an HTTP Request as parameters. This
causes the actual user name/password to be written to the Simple Results
file and be displayed in the View Results Tree > Request tab.
--
View this message in context: http://jmeter.512774.n5.nabble.com/How-to-mask-encrypt-values-sent-as-an-HTTP-request-parameter-tp3200142p3200142.html
Sent from the JMeter - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
Re: Parameter file from file instead of hard coding
Posted by Deepak Shetty <sh...@gmail.com>.
Im not sure , print out your variables(using debug sampler before
your request) and see if your values are changing correctly , if the
variables change values but the authorization manager didnt then it
might be a bug (or feature) of the authorization manager - the
documentation only states per thread so I dont know if it will change
every iteration or not.
On the other hand if the variables remain the same then the problem is
with how you are reading the values from the file which you havent
described.
On Wed, Oct 27, 2010 at 12:39 PM, bharatraj viswamani <vi...@msn.com> wrote:
>
> If i do it for 2 iterations, i see the same user taken from the text file. Do i need to update anything on http authorization manager?
>
>> Date: Wed, 27 Oct 2010 12:08:41 -0700
>> Subject: Re: Parameter file from file instead of hard coding
>> From: shettyd@gmail.com
>> To: jmeter-user@jakarta.apache.org
>>
>> from the manual
>> http://jakarta.apache.org/jmeter/usermanual/component_reference.html#HTTP_Authorization_Manager
>>
>> "If you want to use different usernames/passwords for different
>> threads, you can use variables. These can be set up using a CSV Data
>> Set Config Element (for example). "
>>
>>
>> regards
>> deepak
>>
>> On Wed, Oct 27, 2010 at 12:04 PM, bharatraj viswamani <vi...@msn.com> wrote:
>> >
>> > Using jmeter and http authorization manager, it is possible to give the username to be supplied from a file instead of hard coding?
>> >
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
>> For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
RE: Parameter file from file instead of hard coding
Posted by bharatraj viswamani <vi...@msn.com>.
If i do it for 2 iterations, i see the same user taken from the text file. Do i need to update anything on http authorization manager?
> Date: Wed, 27 Oct 2010 12:08:41 -0700
> Subject: Re: Parameter file from file instead of hard coding
> From: shettyd@gmail.com
> To: jmeter-user@jakarta.apache.org
>
> from the manual
> http://jakarta.apache.org/jmeter/usermanual/component_reference.html#HTTP_Authorization_Manager
>
> "If you want to use different usernames/passwords for different
> threads, you can use variables. These can be set up using a CSV Data
> Set Config Element (for example). "
>
>
> regards
> deepak
>
> On Wed, Oct 27, 2010 at 12:04 PM, bharatraj viswamani <vi...@msn.com> wrote:
> >
> > Using jmeter and http authorization manager, it is possible to give the username to be supplied from a file instead of hard coding?
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
>
Re: Parameter file from file instead of hard coding
Posted by Deepak Shetty <sh...@gmail.com>.
from the manual
http://jakarta.apache.org/jmeter/usermanual/component_reference.html#HTTP_Authorization_Manager
"If you want to use different usernames/passwords for different
threads, you can use variables. These can be set up using a CSV Data
Set Config Element (for example). "
regards
deepak
On Wed, Oct 27, 2010 at 12:04 PM, bharatraj viswamani <vi...@msn.com> wrote:
>
> Using jmeter and http authorization manager, it is possible to give the username to be supplied from a file instead of hard coding?
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
Parameter file from file instead of hard coding
Posted by bharatraj viswamani <vi...@msn.com>.
Using jmeter and http authorization manager, it is possible to give the username to be supplied from a file instead of hard coding?
Re: How to mask/encrypt values sent as an HTTP request parameter
Posted by black gaff <jo...@gmail.com>.
sebb-2-2 wrote:
>
> If you are able to code in Java, then you should be able to use the
> BeanShell Post-Processor to redact the contents of the SampleResult
> (held in the 'prev' variable).
>
> something like:
>
> prev.setSampleData(prev.getSampleData().replace("secret","******"))
>
> Similarly if the secret is in one of the headers (use
> setRequestHeaders() and getRequestHeaders())
>
> Post-Processors are run before Listeners, so any change you make will
> be reflected in the data that is saved.
>
>
After getting some basic java tutorials and learning that the secret text is
written to "Response Data" via simple data writer, I've come up with the
following code:
import org.apache.jmeter.util.JMeterUtils;
import org.apache.jmeter.samplers.SampleResult;
import java.lang.String;
prev.setResponseData(prev.getResponseData().replace("secret","******"));
Unfortunately, it isn't redacting the information as I had hoped. Any
thoughts, oh wise ones?
Also, for others learning to write script for Jmeter, I've found the
following link rather helpful:
http://www.javadocexamples.com/java_examples/org/apache/jmeter/
http://www.javadocexamples.com/java_examples/org/apache/jmeter/
--
View this message in context: http://jmeter.512774.n5.nabble.com/How-to-mask-encrypt-values-sent-as-an-HTTP-request-parameter-tp3200142p3232490.html
Sent from the JMeter - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
Re: How to mask/encrypt values sent as an HTTP request parameter
Posted by black gaff <jo...@gmail.com>.
sebb-2-2 wrote:
>
> If you are able to code in Java, then you should be able to use the
> BeanShell Post-Processor to redact the contents of the SampleResult
> (held in the 'prev' variable).
>
> something like:
>
> prev.setSampleData(prev.getSampleData().replace("secret","******"))
>
> Similarly if the secret is in one of the headers (use
> setRequestHeaders() and getRequestHeaders())
>
> Post-Processors are run before Listeners, so any change you make will
> be reflected in the data that is saved.
>
>
Sebb,
Thanks for the suggestion. I'm not a Java coder, nor have I used the
Beanshell post processors, but I'll certainly take a crack at it. Much
thanks for giving constructive feedback. I'll post back when I get it
working.
--
View this message in context: http://jmeter.512774.n5.nabble.com/How-to-mask-encrypt-values-sent-as-an-HTTP-request-parameter-tp3200142p3200403.html
Sent from the JMeter - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
Re: How to mask/encrypt values sent as an HTTP request parameter
Posted by sebb <se...@gmail.com>.
On 5 October 2010 21:18, black gaff <jo...@gmail.com> wrote:
>
>>> You cannot suppress anything shown in the View Results Tree. Just don't
> use it.
> I thought as much. It makes for a handy debug / teaching tool
>
>>> The data stored by the Simple Data Writer is configurable - e.g
>>> you could save just label, timestamp and elapsed.
>>>
>>> However, if the password is being saved by the default configuration
>>> (which includes the URL but not the data) then you have got a problem
>>> which is nothing to do with JMeter...
>
> For trouble shooting purposes, I've found it very useful to store the
> REQUEST in the output file, as the devs sometimes need the exact sent
> message.
Which of course includes the secret information ...
> I think my work around solution (until some dashing, brave entrepreneurial
> type person wants to write a plugin to address this concern) will be to
> exclude the login request from the Simple Data Writer.
If you are able to code in Java, then you should be able to use the
BeanShell Post-Processor to redact the contents of the SampleResult
(held in the 'prev' variable).
something like:
prev.setSampleData(prev.getSampleData().replace("secret","******"))
Similarly if the secret is in one of the headers (use
setRequestHeaders() and getRequestHeaders())
Post-Processors are run before Listeners, so any change you make will
be reflected in the data that is saved.
>
> --
> View this message in context: http://jmeter.512774.n5.nabble.com/How-to-mask-encrypt-values-sent-as-an-HTTP-request-parameter-tp3200142p3200356.html
> Sent from the JMeter - User mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
Re: How to mask/encrypt values sent as an HTTP request parameter
Posted by black gaff <jo...@gmail.com>.
>> You cannot suppress anything shown in the View Results Tree. Just don't
use it.
I thought as much. It makes for a handy debug / teaching tool
>> The data stored by the Simple Data Writer is configurable - e.g
>> you could save just label, timestamp and elapsed.
>>
>> However, if the password is being saved by the default configuration
>> (which includes the URL but not the data) then you have got a problem
>> which is nothing to do with JMeter...
For trouble shooting purposes, I've found it very useful to store the
REQUEST in the output file, as the devs sometimes need the exact sent
message.
I think my work around solution (until some dashing, brave entrepreneurial
type person wants to write a plugin to address this concern) will be to
exclude the login request from the Simple Data Writer.
--
View this message in context: http://jmeter.512774.n5.nabble.com/How-to-mask-encrypt-values-sent-as-an-HTTP-request-parameter-tp3200142p3200356.html
Sent from the JMeter - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
Re: How to mask/encrypt values sent as an HTTP request parameter
Posted by sebb <se...@gmail.com>.
On 5 October 2010 20:11, black gaff <jo...@gmail.com> wrote:
>
> It would seem I'm not making myself clear enough.
>
> I realize it's possible for someone who is super determined to get the
> password while Jmeter is running. Generally, the person who enters the
> password in the first place is the same person running the script.
>
> I've solved security issue #1 - no passwords stored in the script.
> I need to solve security issue #2 - no passwords are stored in the Simple
> Results Writer nor displayed in View Results Tree.
You cannot suppress anything shown in the View Results Tree. Just don't use it.
The data stored by the Simple Data Writer is configurable - e.g you
could save just label, timestamp and elapsed.
However, if the password is being saved by the default configuration
(which includes the URL but not the data) then you have got a problem
which is nothing to do with JMeter...
>
> --
> View this message in context: http://jmeter.512774.n5.nabble.com/How-to-mask-encrypt-values-sent-as-an-HTTP-request-parameter-tp3200142p3200259.html
> Sent from the JMeter - User mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
Re: How to mask/encrypt values sent as an HTTP request parameter
Posted by Deepak Shetty <sh...@gmail.com>.
Hi
Like I said needs source code modification as far as I know
>I've solved security issue #1 - no passwords stored in the script.
>I need to solve security issue #2 - no passwords are stored in the Simple
>Results Writer nor displayed in View Results Tree.
And my point is you are trying to satisfy the words of the policy rather
than the spirit or what it was meant to safeguard.
regards
deepak
On Tue, Oct 5, 2010 at 12:11 PM, black gaff <jo...@gmail.com>wrote:
>
> It would seem I'm not making myself clear enough.
>
> I realize it's possible for someone who is super determined to get the
> password while Jmeter is running. Generally, the person who enters the
> password in the first place is the same person running the script.
>
> I've solved security issue #1 - no passwords stored in the script.
> I need to solve security issue #2 - no passwords are stored in the Simple
> Results Writer nor displayed in View Results Tree.
>
> --
> View this message in context:
> http://jmeter.512774.n5.nabble.com/How-to-mask-encrypt-values-sent-as-an-HTTP-request-parameter-tp3200142p3200259.html
> Sent from the JMeter - User mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
>
>
Re: How to mask/encrypt values sent as an HTTP request parameter
Posted by black gaff <jo...@gmail.com>.
It would seem I'm not making myself clear enough.
I realize it's possible for someone who is super determined to get the
password while Jmeter is running. Generally, the person who enters the
password in the first place is the same person running the script.
I've solved security issue #1 - no passwords stored in the script.
I need to solve security issue #2 - no passwords are stored in the Simple
Results Writer nor displayed in View Results Tree.
--
View this message in context: http://jmeter.512774.n5.nabble.com/How-to-mask-encrypt-values-sent-as-an-HTTP-request-parameter-tp3200142p3200259.html
Sent from the JMeter - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
Re: How to mask/encrypt values sent as an HTTP request parameter
Posted by Deepak Shetty <sh...@gmail.com>.
need Source code modification as far as I know BUT
Whats preventing a user from adding a debug sampler? whats preventing a
user from invoking the same code that decrypts the password ? What security
have you really added? If you really wanted the password to be secure (which
is the policies intent rather than it is not viewable) you will have to work
at an OS level.
If these are critical passwords then why not let the user enter the password
(either at launch time or by modifying the test) (usually not feasible for
Db passwords but may be feasible for website logins).
On Tue, Oct 5, 2010 at 11:39 AM, black gaff <jo...@gmail.com>wrote:
>
> I realize the password could still be obtained with enough motivation.
>
> I'm working towards ensuring the password is written to the Log File nor
> visible in View Results Tree. It would be great if there was something
> like
> HTTP Authorization Manager or the Login Config Element that worked on HTTP
> Requests
> --
> View this message in context:
> http://jmeter.512774.n5.nabble.com/How-to-mask-encrypt-values-sent-as-an-HTTP-request-parameter-tp3200142p3200202.html
> Sent from the JMeter - User mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
>
>
Re: How to mask/encrypt values sent as an HTTP request parameter
Posted by black gaff <jo...@gmail.com>.
I realize the password could still be obtained with enough motivation.
I'm working towards ensuring the password is written to the Log File nor
visible in View Results Tree. It would be great if there was something like
HTTP Authorization Manager or the Login Config Element that worked on HTTP
Requests
--
View this message in context: http://jmeter.512774.n5.nabble.com/How-to-mask-encrypt-values-sent-as-an-HTTP-request-parameter-tp3200142p3200202.html
Sent from the JMeter - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
Re: How to mask/encrypt values sent as an HTTP request parameter
Posted by Deepak Shetty <sh...@gmail.com>.
> This causes the actual user name/password to be written to the Simple
Results
>file and be displayed in the View Results Tree > Request tab.
There is no way around this as far as I know (unless you are willing to
modify JMeter Source code to suppress certain values). But it only solves
the problem that the password is visible in the listener you could still get
the password if you were motivated enough.
>My company has a rule that user name/passwords cannot be stored in scripts.
And encrypting them and decrypting them just before passing them in(or
within the test itself) should be enough (as you say you are doing). If
anyone argues that it isnt , consider that there has to be a way for JMeter
to access the actual password and if JMeter can do it , so can any
technically competent person (or simpler just use a proxy and configure
JMeter to use the proxy and you will be able to see the password). . For
e.g. if you encrypt the password with a key , all you need to know is the
key to decrypt the password. The key must be accessible to Jmeter so it must
be accessible to the user running JMeter too. All in all not worth it ,
though you might be able to accomplish what you need in *nix systems (by
making Jmeter run as a different user and only allowing the user to run
JMeter (and restricting even read access to all files) but I dont know
enough of unix to say for sure.
On Tue, Oct 5, 2010 at 11:15 AM, black gaff <jo...@gmail.com>wrote:
>
> In short, does anyone know of a workaround to mask/encrypt values sent as
> an
> HTTP request parameter?
>
>
> My company has a rule that user name/passwords cannot be stored in scripts.
>
> In my JMeter scripts, I've gotten around this by passing the user
> name/password through the command line and storing them as properties to be
> retrieved later.
>
> The user name and password are passed in an HTTP Request as parameters.
> This
> causes the actual user name/password to be written to the Simple Results
> file and be displayed in the View Results Tree > Request tab.
> --
> View this message in context:
> http://jmeter.512774.n5.nabble.com/How-to-mask-encrypt-values-sent-as-an-HTTP-request-parameter-tp3200142p3200142.html
> Sent from the JMeter - User mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
>
>
Re: How to mask/encrypt values sent as an HTTP request parameter
Posted by Deepak Shetty <sh...@gmail.com>.
> This causes the actual user name/password to be written to the Simple
Results
>file and be displayed in the View Results Tree > Request tab.
There is no way around this as far as I know (unless you are willing to
modify JMeter Source code to suppress certain values). But it only solves
the problem that the password is visible in the listener you could still get
the password if you were motivated enough.
>My company has a rule that user name/passwords cannot be stored in scripts.
And encrypting them and decrypting them just before passing them in(or
within the test itself) should be enough (as you say you are doing). If
anyone argues that it isnt , consider that there has to be a way for JMeter
to access the actual password and if JMeter can do it , so can any
technically competent person (or simpler just use a proxy and configure
JMeter to use the proxy and you will be able to see the password). . For
e.g. if you encrypt the password with a key , all you need to know is the
key to decrypt the password. The key must be accessible to Jmeter so it must
be accessible to the user running JMeter too. All in all not worth it ,
though you might be able to accomplish what you need in *nix systems (by
making Jmeter run as a different user and only allowing the user to run
JMeter (and restricting even read access to all files) but I dont know
enough of unix to say for sure.
On Tue, Oct 5, 2010 at 11:15 AM, black gaff <jo...@gmail.com>wrote:
>
> In short, does anyone know of a workaround to mask/encrypt values sent as
> an
> HTTP request parameter?
>
>
> My company has a rule that user name/passwords cannot be stored in scripts.
>
> In my JMeter scripts, I've gotten around this by passing the user
> name/password through the command line and storing them as properties to be
> retrieved later.
>
> The user name and password are passed in an HTTP Request as parameters.
> This
> causes the actual user name/password to be written to the Simple Results
> file and be displayed in the View Results Tree > Request tab.
> --
> View this message in context:
> http://jmeter.512774.n5.nabble.com/How-to-mask-encrypt-values-sent-as-an-HTTP-request-parameter-tp3200142p3200142.html
> Sent from the JMeter - User mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jmeter-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: jmeter-user-help@jakarta.apache.org
>
>