@AnanthanarayananS17489518

Sharing the solution I found (in case you're still looking):

You’ll need to capture the variable named PEGA-AAT (present as a response header) from the request that follows the one where the user credentials are submitted. This response comes with an HTTP 303 redirect, so make sure to use testing tool like Jmeter's correlation logic to extract the value from the headers of the redirected URL.

Once you’ve captured the PEGA-AAT value (which is a JWT in the format <header>.<payload>.<signature>), you can split it by the dot (.) to get an array. The second element (the payload) can be Base64-decoded to retrieve a JSON object. This object contains the csrftoken key.

Here is sample JSR223 code in JMeter which may need some adjustment-   

import java.util.Base64;
import org.json.JSONObject;

// Get the JWT token from JMeter variable
String token = vars.get("c_PEGA_AAT");

String csrfToken = "";

if (token != null && token.contains(".")) {
    try {
        String[] parts = token.split("\\.");
        if (parts.length == 3) {
            String base64Url = parts[1]
                .replace('-', '+')
                .replace('_', '/');

            // Pad the Base64 string if needed
            int padLength = 4 - (base64Url.length() % 4);
            if (padLength > 0 && padLength < 4) {
                base64Url += "=".repeat(padLength);
            }

            byte[] decodedBytes = Base64.getDecoder().decode(base64Url);
            String jsonString = new String(decodedBytes, "UTF-8");

            JSONObject payload = new JSONObject(jsonString);

            if (payload.has("csrf")) {
                csrfToken = payload.getString("csrf");
                log.info("Extracted CSRF token: " + csrfToken);
            } else {
                log.warn("CSRF token not found in JWT.");
            }
        } else {
            log.error("Invalid JWT format (not 3 parts).");
        }
    } catch (Exception e) {
        log.error("Error decoding JWT token: " + e.getMessage());
    }
} else {
    log.warn("JWT token is null or invalid.");
}

// Store CSRF token in a JMeter variable for later use
vars.put("csrfToken", csrfToken); // You can access it as ${csrfToken}