How to perform Azure Load Testing for Secure Endpoints with Auth0 Session-Based Authentication

A load testing scenario is being set up for a secure endpoint using Azure Load Testing within an application stack that includes:

• Frontend: React + Next.js
• Authentication: Auth0 with session-based authentication (tokens stored in cookies)

Steps Taken So Far:

1. Created a simple test in Azure Load Testing:
   • Method: GET
     • URL: https://domain.com/my-page-with-secure-endpoint
       • Headers:
         • Authorization: Bearer my-token (copied manually from browser DevTools)
           • Added the authorization header, but the request resulted in a 307 Temporary Redirect instead of a 200 OK.
           1. Tried passing session-based tokens in headers:
              • Auth0 session tokens are stored in cookies (appSession.0, appSession.1).
                • In headers, added Cookie: appSession.0=token; appSession.1=token
                  • The request still resulted in a 307 Temporary Redirect instead of a 200 OK.
                  1. Checked Azure Load Testing documentation:
                     • Noticed references to using JMeter .jmx files, but only an option to upload a .csv file was available.
                       • Uploaded a CSV file with username and password.
                         • Set the login URL as the request URL and attempted to use the generated token in the next API call.
                           • The CSV file does not have any headers—it only contains:

                                                                       [email protected],MySecurePassword
                           

                           -  Specified `username,password` as the **variable names** in Azure Load Testing.
                           
                              -  Encountered the following error when running the test with the login URL:  
                           
                                    -  ❌ **"File login-jmeter.csv must exist and be readable"**
                           
                                       -  Using a **single user to send 100 requests** for the test.
                           

Questions:

1. What is the correct way to authenticate session-based authentication in Azure Load Testing?
   • Should the full login request headers (captured via DevTools) be passed in Azure Load Testing?
     • Is the Authorization token alone sufficient?
       • Do session cookies need to be handled differently in Azure Load Testing?
       1. How can the token be dynamically fetched and used during the test?
          • If dynamic authentication is necessary, how should this be configured in Azure Load Testing?
            • Given that .jmx files cannot be uploaded, what alternative is available to pass authentication dynamically?

The primary goal is to obtain load testing data for the secure endpoint, and there's a willingness to add statically generated tokens or cookies. Any guidance on properly managing Auth0 authentication in Azure Load Testing would be greatly appreciated! 🚀