I haven't been big on the IRC scene for a few years.

What it means by "Jmeter doesn't do Javascript" is that Jmeter doesn't do
Javascript. So if you want to test a javascript-heavy web application, you
can monitor the client-server interactions of the webapp, but jmeter can not
actually run or test the GUI on the web browser. If the client does any
calculations, you'll have to make those calculations yourself in Jmeter.
Easiest way to do that is a BSF sampler.

You still have a lot of wiggle room for testing. The Jmeter recording proxy
WILL record the client/server interactions, so if all you care about is load
you could definitely ramp up a ton of calls to the back-end. They'll always
follow a logical pattern. If the web framework your developers use encode
the messages, that could still be a problem.

I've found that jmeter also provides some excellent security testing for
javascript-heavy apps, too. I've found repeatedly that developers will
encode a constraint in Javascript and think that's enough to prevent
shenanigans in the database. As one example, a size constraint was specified
for a file that gets stored using the web app. Turns out they only validate
it in Javascript. I can happily drop a 2 gigabyte file into the database by
calling the server API with a gigantic file. You could probably find a ton
of those types of bugs in your typical AJAX application.

-- 
Bruce Ide
flyingrhenqu...@gmail.com

Reply via email to