How to correlate a login session in JMeter

Modern web logins rarely pass only a username and password. A JMeter test plan also has to carry the hidden form token, server-issued cookie, and protected follow-up request in the same virtual user session so the load test exercises the authenticated path instead of replaying a stale capture.

Correlation in JMeter pairs post-processors with the sampler that receives the dynamic value. The HTTP Cookie Manager stores server-set cookies per thread, while a CSS Selector Extractor or Regular Expression Extractor captures the form token that must be submitted by the next request.

Build the flow with one user and one loop before increasing thread count. A visible default such as TOKEN_NOT_FOUND makes extractor misses easy to spot, and the protected request should return an authorized response only after both the token and cookie are present.

1. Open a validation copy of the login test plan in the JMeter GUI.
2. Reduce the target Thread Group to one thread and one loop.

   Number of Threads (users): 1
   Loop Count: 1

   Keep the validation run small until the token, cookie, and protected request all pass for one virtual user.

3. Add an HTTP Cookie Manager under the same Thread Group as the login samplers.

   Leave Clear Cookies each Iteration disabled when the later samplers in the same loop should remain logged in.
   Related: How to add a Cookie Manager in JMeter

4. Create or confirm the sampler that opens the login form.

   Name: GET /login
   Method: GET
   Path: /login

5. Add the extractor under GET /login from Add → Post Processors → CSS Selector Extractor.

   Name: Extract login CSRF token
   Name of created variable: csrf_token
   CSS/JQuery expression: form#login input[name=csrf]
   Attribute: value
   Match No.: 1
   Default Value: TOKEN_NOT_FOUND

   Use a Regular Expression Extractor only when the login response cannot be parsed with an HTML selector.
   Related: How to extract HTML values with a CSS Selector Extractor in JMeter
   Related: How to extract values with a regular expression in JMeter

6. Update the login submit sampler to send the extracted token.

   Name: POST /login
   Method: POST
   Path: /login
   
   Parameter: username = qa-user
   Parameter: password = ${password}
   Parameter: csrf = ${csrf_token}

   Do not save live passwords, bearer tokens, or session cookies as literal values in a shared .jmx file. Load them from a variable source, test data file, or command-line property.

7. Place the protected request after the login submit sampler.

   Name: GET /account
   Method: GET
   Path: /account

   Do not add a manual Cookie header for the session. The HTTP Cookie Manager sends the server-issued cookie when the domain and path match.

8. Save the validation test plan.

   login-session-correlate.jmx

9. Run the one-user smoke test from the command line.

   $ jmeter -n -t login-session-correlate.jmx -l login-session-results.jtl
   Creating summariser <summary>
   Created the tree successfully using login-session-correlate.jmx
   Starting standalone test @ 2026 Jun 30 06:52:47 GMT
   Waiting for possible Shutdown/StopTestNow/HeapDump/ThreadDump message on port 4445
   summary =      3 in 00:00:00 =   23.4/s Avg:     7 Min:     1 Max:    20 Err:     0 (0.00%)
   Tidying up ...
   ... end of run

   Related: How to run a JMeter test from the command line

10. Check the result file for successful login, submit, and protected samplers.

    $ cat login-session-results.jtl
    timeStamp,elapsed,label,responseCode,responseMessage,threadName,dataType,success,failureMessage,bytes,sentBytes,grpThreads,allThreads,URL,Latency,IdleTime,Connect
    1782802367836,20,GET /login,200,OK,Login correlation user 1-1,text,true,,256,123,1,1,http://127.0.0.1:18083/login,16,0,13
    1782802367890,2,POST /login,200,OK,Login correlation user 1-1,text,true,,155,280,1,1,http://127.0.0.1:18083/login,2,0,2
    1782802367893,1,GET /account,200,OK,Login correlation user 1-1,text,true,,99,160,1,1,http://127.0.0.1:18083/account,1,0,1

    The success column should show true for every sampler in the login path.

11. Check the application log, mock endpoint log, or View Results Tree request data for the correlated values.

    $ cat login-session-server.log
    server=listening port=18083
    request method=GET path=/login cookie=- csrf=- status=200
    request method=POST path=/login cookie=- csrf=csrf-abc-123 status=200
    request method=GET path=/account cookie=SESSIONID=session-abc-123 csrf=- status=200

    The POST line should show the extracted csrf value, and the protected request should show the session cookie from the login response. If the token is TOKEN_NOT_FOUND or the cookie is missing, inspect the extractor output before increasing thread count.
    Related: How to add a Debug Sampler in JMeter