How to login to Laravel site which has recaptch with multiple VUs?

Grafana k6
1

Hi,

I am new to K6 and I have a request to Load Test a site with up to 100 vu’s but the problem I am facing is that the site requires you to login. The login is using Laravel so I need a XSRF-TOKEN and a laravel_session but when I try and login it does not work it complains about Captcha Failed.

I’ve done a lot of googling and I want someone to just answer a few questions for me please it will help clear some stuff up?

I understand how to test a site without authentication and it works fine but how do I get all these users to login? These are VUs so they do not have any username or password so how do I create this? Do I need to create each users in the UI/DB and then store these credentials in a file and then loop through this in k6? Say if I want to do 5000 users this would be a nightmare?

Is my thought process right in the first place? I was thinking that I need to login with all 100 users and then hit an API such as editUser with all 100 users at the same time? I could obviously ramp this up but you get what I mean. Is this the approach you would take for load testing a site?

This is all very simple if you don’t need to login you can bypass all this but unfortuantely I do need to login to access these APIs.

export function setup() {
    // STEP 1: GET /login to receive CSRF token and cookies
    const loginPage = http.get(`${BASE_URL}/login`);
  
    const xsrfToken = decodeURIComponent(loginPage.cookies['XSRF-TOKEN'][0].value);
    const cookies = {
      'XSRF-TOKEN': loginPage.cookies['XSRF-TOKEN'][0].value,
      'laravel_session': loginPage.cookies['laravel_session'][0].value,
    };
  
    // STEP 2: Prepare login payload (form-encoded)
    const payload = `email=${USERNAME}&password=${PASSWORD}`;
  
    const headers = {
      'Content-Type': 'application/x-www-form-urlencoded',
      'X-XSRF-TOKEN': xsrfToken, // required by Laravel
    };
  
    // STEP 3: POST login with cookies and CSRF token
    const loginRes = http.post(`${BASE_URL}/login`, payload, {
      headers,
      cookies,
      redirects: 0,
    });
  
  
    const authCheck = http.get(`${BASE_URL}/myleagues`, {
        headers,
        cookies,
        redirects: 0,
      });
      
    check(authCheck, {
    '✅ authenticated access to /myleagues': (r) =>
        r.status === 200,
    '❌ not redirected back to login': (r) =>
        !(r.status === 302 && r.headers.Location && r.headers.Location.includes('/login')),
    });
  
    return {
      cookies: loginRes.cookies,
    };
  }

This is what I was trying with to see if I could login with just one user but that doesn’t work yet because of the captcha.

Please help!

Thanks

Ben

3

There’s a couple of issues here.

The login is using Laravel so I need a XSRF-TOKEN and a laravel_session

Firstly, you may find it easier to use a real browser. I am new to Grafana Cloud, but they do have real browsers in their Synthetics offering (I am testing that myself). So to sign in, you would visit the form, fill in credentials, and click the Login button. Since Laravel renders the XSRF-TOKEN for you, inside the form, you won’t need to do it manually.

it does not work it complains about Captcha Failed

That’s a different failure: XSRF is not CAPTCHA. The failure in this error message is the automated user not having filled in a visual puzzle (which, of course, it can’t). You will need to modify your app to disable the CAPTCHA device in your load tests.

4

I assume VU is “virtual user”. I don’t know what that is exactly, but yes, when one is doing E2E testing, synthetics testing, load testing etc, if you have to sign in, then your test platform needs to be aware of sign-in credentials.

Just find the code in your platform that creates users and get it to work on the console. You certainly would not create 5000 logins manually. Are you sure you need 5000 separate users though? Can they not login simultaneously? They should all get their own independent session.

5

Yes, that’s the idea. But if you’re load testing, you may be able to do something 100 times in parallel with just one user, or just a handful of users. Determine if you really need 100 different users doing a thing if you are operating 100 separate threads.

6

Hi @jonh ,

Thanks for the replies, so I have made some progress, it seems it was as simple as getting the dev to whitelist my IP and this allowed me to login using Postman or K6 so that is great!

I completed some more investigation and it seems like the best option for me is to manually create 20 users and then hit the API in multiple iterations. So if we have 20 users, I can tell them each to iterate 10 times and this will run concurrently.

My first thought was to just use one account but I don’t think this is realistic.

I was getting confused because I thought in order to test 500 responses i’d need 500 users, but its not, I could use 5 users but hit the endpoint 100 times each concurrently.

Thanks!