I would like to perform a load test on a site that uses ValidateAntiForgeryTokens on a number of HttpPosts. However, as you would expect, when I run my load test script, I receive a number of 500 errors because the __RequestVerificationToken is either copied from an earlier request or is blank. Both of which fail.
Are there any ways to load test sites where I am using the ValidateAntiForgeryToken attribute on my HttpPost methods?
I’ve tried using StresStimulus and also SmartBear’s LoadComplete for my tests.
If you are using fiddler and http://stresstimulus.stimulustechnology.com/ (which I haven’t used) I have to imagine you can first login, and then use that session as your load. The AntiForgeryTokens are NOT one time, and as long as the cookie is there for your auth info and an anti forgery token generated during that login session, it should be fine.