Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For HTTPs I saw the URL was configured in < string of alphanumeric chars, 160 in count >

<< this a dummy hostname, with dummy parameters used for example >>

This set up was done to send xml file via HTTP.

I am new to such configuration and I am not able to figure out how exactly its functioning.

Transformer=TEST : I am thinking it to be user id ( unique account id ), pl correct me if it is some other parameter, and how to get it ?

UDIAuthToken= I am not understanding what exactly this parameter is, and how we get it ? Is this a Hash o/p of the ssl certificate?

share|improve this question
up vote 5 down vote accepted

Thankfully I am enormously competent with the Internet, and my incredibly extended experience made me aware of a very convenient, if somewhat confidential, service called Google. Interacting with this service for "UDIAuthToken" uncovered some pretty deep secrets, in particular that this parameter appears to be connected with a product called OMX from OrderMotion -- apparently a software platform for doing e-commerce. A parameter called "UDIAuthToken" is shown as part of some XML-based syntax in this document with this comment: <!---- Info. by OM --->

From this information, I infer that the "UDIAuthToken" parameter is a value which, from the API user's point of view (that's you), is quite opaque and is supposed to be provided "as is" by the software vendor. Thus, it probably encodes some license information. 160 hexadecimal characters means 80 bytes; with Base64 it would be 120 bytes. That's more than a simple hash; that's actually enough to do some serious cryptography, including encryption and signatures. IF this cryptography was done properly (an always risky bet, given the average competence of developers in the whole industry), THEN you would have a hard time forging a fake value for this parameter that the server would accept. After all, the point of licensing tokens is to remain under exclusive control of the software vendor.

share|improve this answer
Truly, we'd all be lost on the Internet without you, Tom. – tylerl Dec 24 '13 at 17:53

The UDIAuthtoken is the value you find within the OMX control panel, it is set up specifically for a vendor to use to connect within order motion, for example, the call center will have a specific token, the web, fulfillment, credit card merchant etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.