Checkpoint Lab — Security, Data Protection, Authorization, and Safe Load-Test Boundaries

1. Exact assumptions and ceilings

2. Freeze the evidence/protocol before traffic

1. Review scope/authorization.json.
2. Hash scope, JMX and safe.properties.
3. Verify target fixture command binds only to127.0.0.1 and ceilings30/25.
4. Verify JMX uses properties for token/target and exact3×10 workload.
5. Verify result-save policy disables bodies/headers/URL.
6. Set only the documented fake token.

3. Predictions before execution

P1 — denied target: passing https://example.com as input will return exit30 before DNS/network/JMeter; guard evidence will show both booleans false and local target work_attempts remains0.

P2 — allowed run: exact loopback target produces30 successful JTL samples and30 target successes with no auth/scope/rate rejection.

P3 — secret boundary: the fake token never appears in JMX, CLI arguments, JTL, jmeter.log, dashboard or target events; only a SHA-256 fingerprint/redacted bearer marker can be retained.

P4 — cleanup: temporary secret properties are gone when launcher exits and target port8031 is closed after fixture shutdown.

4. Start authorized target/preflight

$env:P31_FAKE_TOKEN = "p31-fake-token-4e65d5cf"

python .\fixtures\safe_target.py `
  --host 127.0.0.1 --port 8031 `
  --max-requests 30 --max-rps 25 `
  --log .\results\target-events.jsonl

Keep this fixture shell open. In a second shell inspect /health; do not send /work manually.

5. Demonstrate non-allow-listed target fails before traffic

python .\tools\safe_launcher.py `
  --scope .\scope\authorization.json `
  --target-url https://example.com `
  --jmx .\plans\safe-load.jmx `
  --properties .\config\safe.properties `
  --threads 3 --loops 10 --pacing-ms 200 `
  --out .\results\rejected-target

$DeniedExit = $LASTEXITCODE
if ($DeniedExit -ne 30) { throw "Expected exit30" }

Get-Content .\results\rejected-target\guard.json
curl.exe --fail --silent http://127.0.0.1:8031/stats

Require: scope denied; no network/JMeter invocation by the launcher; target work_attempts=0. The public-looking URL string is never contacted.

6. Execute the authorized bounded plan

python .\tools\safe_launcher.py `
  --scope .\scope\authorization.json `
  --target-url http://127.0.0.1:8031 `
  --jmx .\plans\safe-load.jmx `
  --properties .\config\safe.properties `
  --threads 3 --loops 10 --pacing-ms 200 `
  --out .\results\authorized

if ($LASTEXITCODE -ne 0) { throw "Authorized run failed" }

The launcher validates scope/workload first, checks health, creates a short-lived secret properties file, invokes JMeter CLI, removes the token from JMeter's inherited environment, deletes the temporary file and records its status.

7. Independently verify load and guard state

Get-Content .\results\authorized\guard.json
curl.exe --fail --silent http://127.0.0.1:8031/stats

(Get-Content .\results\authorized\results.jtl | Measure-Object -Line).Lines
Get-Item .\results\authorized\jmeter.log,
         .\results\authorized\dashboard\index.html

Expect exactly30 data rows plus CSV header, target successes=30, zero auth/scope/rate failures, launcher PASS and temporary-secret deletion true.

8. Prove evidence is redacted

python .\tools\scan_artifacts.py `
  --root .\results\authorized `
  --secret-env P31_FAKE_TOKEN `
  --out .\results\authorized\redaction-scan.json

if ($LASTEXITCODE -ne 0) { throw "Redaction scan failed" }

Also inspect target events: only Bearer <redacted>, token fingerprint, body hash/field names/size and timing may appear. No raw request body/body values are retained.

9. Abort procedure

During a real authorized run, immediately stop/kill the generator when any predeclared abort condition fires; stop remote engines if applicable; target-side guard should reject excess traffic independently. Preserve current JTL/log/target/guard evidence before deleting processes/files. For this local lab, Ctrl+C/Stop-Process is sufficient because no remote engine exists.

10. Cleanup and audit

Stop the fixture, then:

python .\tools\cleanup_audit.py `
  --host 127.0.0.1 --port 8031 `
  --guard .\results\authorized\guard.json `
  --redaction-scan .\results\authorized\redaction-scan.json `
  --out .\results\cleanup-audit.json

Remove-Item Env:P31_FAKE_TOKEN
Get-Content .\results\cleanup-audit.json

Require cleanup PASS: port closed, temp secret file deleted, redaction PASS and allowed run PASS.

11. Required evidence packet

12. Example checkpoint conclusion

13. Production operating-model addition and Chapter32 bridge

Chapter31 adds a safe-load-test governance contract: explicit authorization, exact target allow-list, trusted JMX/code review, synthetic/masked-data decision, secret-injection boundary, TLS/RMI identity verification, independent workload/time/rate aborts, configured-versus-achieved reporting, lean/redacted artifacts, restricted retention/access and cleanup/audit are required before a performance test is operationally acceptable.

Chapter32 moves to Plugins, Custom Components, JMeter APIs, and Extension Strategy. That chapter expands JMeter's executable surface, so the trust lessons here become supply-chain and extension-design requirements: every plugin/JAR/custom sampler is code with version, provenance, privilege and data-access implications.

Knowledge check

Official references and version notes

• Apache JMeter downloads — current stable JMeter 5.6.3 and Java 8+ requirement.
• JMeter current changes — Java 17+ recommendation for the 5.6.x line.
• Apache JMeter Security Model — JMX is trusted input and may execute arbitrary code; isolate untrusted plans.
• JMeter Component Reference — Authorization Manager passwords are stored unencrypted in the test plan; recorder certificate behavior and SSL components.
• JMeter Properties Reference — result-save fields and RMI SSL settings.
• JMeter Remote Testing — RMI SSL defaults and keystore setup.
• HTTP(S) Test Script Recorder — recording workflow and temporary CA trust requirements.