An information processing apparatus connected to a network (12, 302), the information processing apparatus comprising: a first session managing unit configured to manage a transaction including a request and a response over the network (12, 302); a second session managing unit configured to manage authentication identification information of an authenticated user; a token generating unit configured to acquire authentication identification information of a requesting user and generate a token value to be included in a first response, in response to a first request; and a token validating unit configured to acquire the authentication identification information of the requesting user in response to a second request and validate correctness of a token value included in the second request, characterized in that in response to a first request, the token generating unit calculates an authentication token value using one of the authentication identification information of a requesting user, the authentication identification information of a transaction or user agent information acquired from the first request as a first seed and an internally managed value as a second seed; in response to a second request including an authentication token, the token validating unit acquires an embedded token value included in the authentication token and calculates a validating token value using one of the authentication identification information of a requesting user, the authentication identification information of a transaction or user agent information acquired from the second request as a first seed and the internally managed value as a second seed; and a token validation is realized by comparing the embedded token value acquired from the second request with the calculated validating token value. a first session managing unit configured to manage a transaction including a request and a response over the network (12, 302); a second session managing unit configured to manage authentication identification information of an authenticated user; a token generating unit configured to acquire authentication identification information of a requesting user and generate a token value to be included in a first response, in response to a first request; and a token validating unit configured to acquire the authentication identification information of the requesting user in response to a second request and validate correctness of a token value included in the second request, characterized in that in response to a first request, the token generating unit calculates an authentication token value using one of the authentication identification information of a requesting user, the authentication identification information of a transaction or user agent information acquired from the first request as a first seed and an internally managed value as a second seed; in response to a second request including an authentication token, the token validating unit acquires an embedded token value included in the authentication token and calculates a validating token value using one of the authentication identification information of a requesting user, the authentication identification information of a transaction or user agent information acquired from the second request as a first seed and the internally managed value as a second seed; and a token validation is realized by comparing the embedded token value acquired from the second request with the calculated validating token value.