How QCDR Private Preview Authorization Protects Test Requests

QCDR 1.1.05 does not treat a ?qcdr_test=preview query string as permission to run a private Rule. The Rule editor issues a signed, short-lived authorization that is validated again by the frontend runtime before Preview is allowed.

If that authorization is missing, malformed, expired, mismatched to the Rule, or no longer belongs to an eligible administrator, QCDR fails closed and applies no private Rule.

Who Can Receive a Preview Authorization

Preview & Rule Health must be available at the current plan level, and the Rule editor issues the token only when the current administrator is a non-guest user with both Super User / core.admin authority for QCDR and the Test Rules ACL.

What the Signed Authorization Binds

The token payload is signed with a site-specific HMAC key and contains the authorized user ID, exact Rule ID, expiration time, and a random nonce. The runtime rejects a token when its signature is wrong, its Rule ID does not match the requested Rule, its nonce/payload format is invalid, or its expiration is outside the allowed window.

The Preview authorization lifetime is 900 seconds (15 minutes). Reloading the saved Rule editor creates a fresh token for that Rule.

The Runtime Rechecks the Administrator

Validation does not stop at a mathematically valid signature. QCDR loads the signed user ID and rejects the request if that Joomla user is missing, guest, blocked, no longer has core.admin, or no longer has the QCDR Test Rules permission.

Frontend-Only and Same-Site Boundaries

The Administrator launch control accepts only a frontend URL on the configured Joomla site and rejects external origins and /administrator paths. The runtime itself also processes site-client HTML only; Administrator output, non-HTML formats, and selected sensitive com_users login/reset/remind views are outside the runtime boundary.

Failed Authorization Is Still a Private Diagnostic Response

When a request asks for Preview but authorization is invalid or expired, QCDR does not fall back to ordinary private-test processing. It strips internal render markers, applies no private Rule, adds a PREVIEW NOT AUTHORIZED panel, and tells you to return to the Rule editor for a fresh authorization.

Caching and Search-Engine Protection

  • Cache-Control: private, no-store, no-cache, must-revalidate
  • Pragma: no-cache and an immediate Expires value
  • X-Robots-Tag: noindex, nofollow, noarchive
  • Joomla page caching disabled for the preview request where possible

Preview Parameters Do Not Change Rule Targeting

Before QCDR evaluates normal URL/query conditions, it removes its own preview parameters from the request context. The authorization controls the diagnostic request, but the Rule is judged against the frontend URL as though those QCDR preview parameters were not part of the page's normal targeting data.

Treat the Preview URL as Temporary Sensitive Data

The signed query value is a short-lived authorization credential. Do not publish or share preview URLs. Use Exit Preview when finished, and reload the Rule editor if you need a fresh authorization.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDR feature? Visit the QC Dynamic Replacer Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.