jmeter:login-session-correlate

Modern web logins rarely pass only a username and password. A JMeter test plan also has to carry the hidden form token, server-issued cookie, and protected follow-up request in the same virtual user session so the load test exercises the authenticated path instead of replaying a stale capture.

Correlation in JMeter pairs post-processors with the sampler that receives the dynamic value. The HTTP Cookie Manager stores server-set cookies per thread, while a CSS Selector Extractor or Regular Expression Extractor captures the form token that must be submitted by the next request.

Build the flow with one user and one loop before increasing thread count. A visible default such as TOKEN_NOT_FOUND makes extractor misses easy to spot, and the protected request should return an authorized response only after both the token and cookie are present.

Open a validation copy of the login test plan in the JMeter GUI.
Reduce the target Thread Group to one thread and one loop.
```
Number of Threads (users): 1
Loop Count: 1
```
Keep the validation run small until the token, cookie, and protected request all pass for one virtual user.
Add an HTTP Cookie Manager under the same Thread Group as the login samplers.

Leave Clear Cookies each Iteration disabled when the later samplers in the same loop should remain logged in.
Related: How to add a Cookie Manager in JMeter
Create or confirm the sampler that opens the login form.
```
Name: GET /login
Method: GET
Path: /login
```
Add the extractor under GET /login from Add → Post Processors → CSS Selector Extractor.
```
Name: Extract login CSRF token
Name of created variable: csrf_token
CSS/JQuery expression: form#login input[name=csrf]
Attribute: value
Match No.: 1
Default Value: TOKEN_NOT_FOUND
```
Use a Regular Expression Extractor only when the login response cannot be parsed with an HTML selector.
Related: How to extract HTML values with a CSS Selector Extractor in JMeter
Related: How to extract values with a regular expression in JMeter
Update the login submit sampler to send the extracted token.
```
Name: POST /login
Method: POST
Path: /login

Parameter: username = qa-user
Parameter: password = ${password}
Parameter: csrf = ${csrf_token}
```
Do not save live passwords, bearer tokens, or session cookies as literal values in a shared .jmx file. Load them from a variable source, test data file, or command-line property.
Place the protected request after the login submit sampler.
```
Name: GET /account
Method: GET
Path: /account
```
Do not add a manual Cookie header for the session. The HTTP Cookie Manager sends the server-issued cookie when the domain and path match.
Save the validation test plan.
```
login-session-correlate.jmx
```

Run the one-user smoke test from the command line.

$ jmeter -n -t login-session-correlate.jmx -l login-session-results.jtl
Creating summariser <summary>
Created the tree successfully using login-session-correlate.jmx
Starting standalone test @ 2026 Jun 30 06:52:47 GMT
Waiting for possible Shutdown/StopTestNow/HeapDump/ThreadDump message on port 4445
summary =      3 in 00:00:00 =   23.4/s Avg:     7 Min:     1 Max:    20 Err:     0 (0.00%)
Tidying up ...
... end of run

Check the result file for successful login, submit, and protected samplers.

$ cat login-session-results.jtl
timeStamp,elapsed,label,responseCode,responseMessage,threadName,dataType,success,failureMessage,bytes,sentBytes,grpThreads,allThreads,URL,Latency,IdleTime,Connect
1782802367836,20,GET /login,200,OK,Login correlation user 1-1,text,true,,256,123,1,1,http://127.0.0.1:18083/login,16,0,13
1782802367890,2,POST /login,200,OK,Login correlation user 1-1,text,true,,155,280,1,1,http://127.0.0.1:18083/login,2,0,2
1782802367893,1,GET /account,200,OK,Login correlation user 1-1,text,true,,99,160,1,1,http://127.0.0.1:18083/account,1,0,1

The success column should show true for every sampler in the login path.

Check the application log, mock endpoint log, or View Results Tree request data for the correlated values.
```
$ cat login-session-server.log
server=listening port=18083
request method=GET path=/login cookie=- csrf=- status=200
request method=POST path=/login cookie=- csrf=csrf-abc-123 status=200
request method=GET path=/account cookie=SESSIONID=session-abc-123 csrf=- status=200
```
The POST line should show the extracted csrf value, and the protected request should show the session cookie from the login response. If the token is TOKEN_NOT_FOUND or the cookie is missing, inspect the extractor output before increasing thread count.
Related: How to add a Debug Sampler in JMeter

How to correlate a login session in JMeter

Steps to correlate a JMeter login session: