X-SDL-Tridion-Token in http requests?

Question

What is the meaning of this "token" in header requests going to internal services?

Especially interests me the number put into this "token"...like it doesn't have any meaning, seems like Tridion will serve any request even if some random number is put there into request's header like: "x-sdl-tridion-token: 1361886823834"?

Have a thought that it's being generated on the fly on client side by a javascript code for some reason. Let me know if you have any additional info about it or if I'm wrong correct me please!

I assume, to make some automated request/response internal tests, also the SMSESSION value has to be filled into the request header... Is there something else I may miss from the header of my requests?

Thanks,
bvl

Answer 1

This token is entirely related to the security http modules for CME: Tridion.Web.UI.Core.Http.AntiCsrfModule and Tridion.Web.UI.Core.Http.AntiCsrfBasicModule. They are both part of the Core (Tridion.Web.UI.Core.dll).

The CME uses by default Tridion.Web.UI.Core.Http.AntiCsrfBasicModule which requires a random number. It seems that you are trying to call an internal CME service, they need that header in the Http Request.

This is an internal not supported functionality and can be changed in future releases.

Answer 2

I've seen this too, it looks like an anti-CSRF mechanism.

I'm not entirely sure how/where the token is set, but I suspect a close reading of a fiddler trace will help answer that question.