Perform Load and Stress Testing in Laravel Application

Shuvro
Post View Count: 12
Reading Time: 3 minutes

To perform load and stress testing in a Laravel application, you can use native PHP-based tools or external industry-standard utilities. 

1. PHP-Native Tools (Easiest for Developers)

These tools allow you to write tests in PHP, keeping them within your existing development workflow. 

  • Pest Stressless: A plugin for the Pest Testing Framework that provides a simple CLI command to stress test any URL.
    • Installation: composer require pestphp/pest-plugin-stressless –dev
    • Usage: vendor/bin/pest stress http://localhost:8000 –concurrency=5
  • Volt-Test PHP SDK: A performance testing package that integrates with PHPUnit. It handles complex scenarios like CSRF tokens and session-based authentication (e.g., Laravel Sanctum).
    • Installation: composer require volt-test/laravel-performance-testing
    • Feature: Allows you to define “Virtual Users” and ramp-up periods directly in your test classes. 

2. External Industry Tools (For Advanced Scenarios)

If you need to simulate thousands of users or require detailed graphical reports, use these external tools:

  • k6 (by Grafana): Highly recommended for modern APIs. You write scripts in JavaScript to define user journeys.
  • Locust: A Python-based tool that is excellent for complex, distributed load testing across multiple machines.
  • Apache JMeter: A veteran Java-based GUI tool. While powerful, it can be difficult to configure for modern Laravel authentication like CSRF and Sanctum without extra effort. 

3. Critical Configuration Steps

To get accurate results, do not test against a local php artisan serve instance, as it is single-threaded and will fail under minimal load. 

  1. Use a Production-like Environment: Test on a server running Nginx/Apache with PHP-FPM to allow concurrent request handling.
  2. Optimize Laravel: Before testing, run php artisan optimize to cache your routes and configuration.
  3. Monitor Bottlenecks: Use tools like Laravel Telescope or htop to watch for CPU spikes, N+1 database queries, or memory leaks during the test.
  4. Database Strategy: Use Model Factories to seed a realistic amount of data so your queries are tested against a real-world database size. 

Summary of Testing Types

  • Load Testing: Simulates expected traffic to ensure response times stay within limits.
  • Stress Testing: Pushes the application beyond limits to find the exact breaking point and see how it recovers. 

Testing a public-facing Laravel website

Testing a public-facing Laravel website requires simulating real user behavior, which often includes handling CSRF protection and session-based authentication. Unlike API testing, your scripts must mimic a browser’s lifecycle. 

1. Recommended Tool: k6 (Modern & Powerful) 

k6 (by Grafana) is ideal for Laravel because it handles cookies automatically and allows you to parse HTML for CSRF tokens. 

Sample k6 Script for Laravel Login:

javascript

import http from ‘k6/http’;

import { check, sleep } from ‘k6’;

import { parseHTML } from ‘k6/html’;

export default function () {

    // 1. Visit Login Page to get CSRF token

    const loginPage = http.get(‘https://your-laravel-site.com’);

    const doc = parseHTML(loginPage.body);

    const csrfToken = doc.find(‘input[name=”_token”]’).val();

    // 2. Perform Login

    const loginData = {

        _token: csrfToken,

        email: ‘testuser@example.com’,

        password: ‘password123’,

    };

    const response = http.post(‘https://your-laravel-site.com’, loginData);

    check(response, {

        ‘logged in successfully’: (r) => r.status === 200 && r.url.includes(‘/dashboard’),

    });

    sleep(1); // Simulate real user “think time”

}

NOTE: Use code with caution.

2. Native PHP Tool: Volt-Test (Developer Friendly)

If you prefer staying within the PHP ecosystem, the Volt-Test PHP SDK integrates directly with PHPUnit and handles Laravel-specific flows like extraction of dynamic CSRF values. 

  • Installation: composer require volt-test/laravel-performance-testing
  • Benefit: You can reuse your existing database factories to seed test data before running the load test. 

3. Alternative: Locust (Python-based)

For highly distributed testing across multiple machines, Locust is a popular open-source choice. 

  • Key Challenge: You must manually capture the XSRF-TOKEN from the initial response cookies and include it in the _token field of subsequent POST requests to avoid 419 Page Expired errors. 

4. Implementation Checklist

  • Disable Throttling: For the duration of the test, temporarily disable or increase limits in your App\Providers\RouteServiceProvider or RateLimiter to prevent your own server from blocking the test “users”.
  • Session Driver: Use a production-ready session driver like redis or database during testing. Testing with the file driver can cause I/O bottlenecks that don’t reflect real-world performance.
  • Environment: Always test against a Staging environment that mirrors your Production hardware. Testing locally on your laptop will not provide accurate results.