What is the meaning of this "token" in header requests going to internal services?

Especially interests me the number put into this "token"...like it doesn't have any meaning, seems like Tridion will serve any request even if some random number is put there into request's header like: "x-sdl-tridion-token: 1361886823834"?

Have a thought that it's being generated on the fly on client side by a javascript code for some reason. Let me know if you have any additional info about it or if I'm wrong correct me please!

I assume, to make some automated request/response internal tests, also the SMSESSION value has to be filled into the request header... Is there something else I may miss from the header of my requests?


  • SMSESSION is not related to Tridion. It is generated and used by SiteMinder, you notice this when your are using SSO with CA SiteMinder.
    – Ram G
    Sep 23, 2013 at 20:33

2 Answers 2


This token is entirely related to the security http modules for CME: Tridion.Web.UI.Core.Http.AntiCsrfModule and Tridion.Web.UI.Core.Http.AntiCsrfBasicModule. They are both part of the Core (Tridion.Web.UI.Core.dll).

The CME uses by default Tridion.Web.UI.Core.Http.AntiCsrfBasicModule which requires a random number. It seems that you are trying to call an internal CME service, they need that header in the Http Request.

This is an internal not supported functionality and can be changed in future releases.


I've seen this too, it looks like an anti-CSRF mechanism.

I'm not entirely sure how/where the token is set, but I suspect a close reading of a fiddler trace will help answer that question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.