Next Practical Step
Add Cookie Manager, re-run one thread, and correlate the first dynamic token on the response before the first 401.
Fix JMeter 401 and 403 after HTTP(S) recording: Cookie Manager, CSRF correlation, expired tokens, Header Manager scope, and CSV users. Symptom and fixes.
401 / 403 after recording
Section titled “401 / 403 after recording”Symptom
Section titled “Symptom”- Recording in the browser works and samplers appear under the Recording Controller
- Replay in JMeter returns 401 Unauthorized or 403 Forbidden on login-protected steps
- First sampler may work; later calls fail
- Or all calls fail after the recorded session cookie/token expires
This is one of the most common post-recorder failures (HTTP recorder, best practices).
Common causes
Section titled “Common causes”| Cause | Detail |
|---|---|
| Missing Cookie Manager | Session cookies from Set-Cookie not stored per thread (web test plan) |
| Hard-coded CSRF / viewstate / nonce | Values from the recording are stale (correlation) |
| Hard-coded Bearer / session token | JWT expired; need extract + Header Manager (JWT/OAuth) |
| Header Manager scope wrong | Authorization not applied to the failing sampler |
| Same user / concurrency rules | App rejects parallel sessions for one account |
| Include/exclude left noise out | Login API calls never recorded |
| HTTPS recorder cert issues during capture | Incomplete journey recorded (unknown_ca per best practices) |
Fix (ordered)
Section titled “Fix (ordered)”- Replay with 1 thread, View Results Tree on; find the first 401/403.
- Add an HTTP Cookie Manager at Test Plan or Thread Group level.
- Compare the failing request to the previous response: look for tokens in HTML/JSON/headers.
- Add JSON or Regular Expression Extractor; replace hard-coded values with
\${var}(correlation guide, Regex Extractor Builder). - For APIs: extract
access_token, set headerAuthorizationtoBearer `\${accessToken}`(JWT/OAuth). - Use CSV Data Set for unique users when the app requires it (best practices multi-user pattern).
- Assert login success (status + body) so silent auth failure does not flood later steps.
- Disable Tree, run CLI, confirm error % on the dashboard.
Related tools and topics
Section titled “Related tools and topics”| Resource | Use when |
|---|---|
| Correlation | Extract dynamic fields |
| Regex Extractor Builder | Draft regex from a response body |
| HTTP recorder | Capture and cleanup |
| JWT / OAuth / SSO | Token APIs |
| API load testing | Assertions and headers |
Frequently asked questions
Section titled “Frequently asked questions”Why did recording work if replay returns 401?
Section titled “Why did recording work if replay returns 401?”Recording used your live browser session. Replay is a new session unless cookies and tokens are correlated for each virtual user.
Do I need extractors if I only use Cookie Manager?
Section titled “Do I need extractors if I only use Cookie Manager?”Cookies often cover classic server sessions. CSRF tokens, hidden fields, and Bearer tokens still need extractors.
Can 403 be a WAF or CSRF failure?
Section titled “Can 403 be a WAF or CSRF failure?”Yes. Correlate anti-forgery tokens and required headers; match the browser’s security headers when they are mandatory.
People Also Ask
Why do I get 401 after recording a JMeter script?
Replay starts a new session. Recorded cookies and tokens are often stale. Add a Cookie Manager and correlate CSRF tokens, hidden fields, or Bearer tokens for each virtual user.
Do I need extractors if I already have a Cookie Manager?
Cookies often handle classic server sessions. CSRF tokens, hidden form fields, and Authorization bearer tokens still need extractors.
Was this page helpful?
Thanks for the feedback!Tell us what's missing on GitHub