What a QCFUM Invite Link Contains and How It Is Protected

A QCFUM Invite Link is a bearer-style setup URL containing a one-time secret token. Anyone who possesses an active token can present it to QCFUM, so the token must be treated like a private credential until the invitation is completed, expired, cancelled, rejected, or replaced.

QCFUM 2.0.4 does not store that raw token in the Invite Link business row. It stores a keyed hash and compares a submitted URL token by hashing it again.

Token Generation and Storage

QCFUM requests 32 random bytes and encodes them as hexadecimal, producing a long random token under normal operation. The stored value is an HMAC-SHA256 hash of that token using the Joomla site secret. The recipient URL carries the raw token; the database Invite Link row carries the hash.

When a recipient opens the URL, QCFUM hashes the presented token and looks for a matching current or staged hash. The raw link secret is therefore not normal plaintext business metadata in the Invite Link row.

Why QCFUM Uses Built-In Delivery Controls

The frontend manager is not shown the newly created raw Invite Link. The normal workflow sends it directly to the recipient through the configured email template. This reduces accidental disclosure in staff chat, screenshots, tickets, or copy/paste history.

Manual Nudge/Resend rotates the token. QCFUM first stages the new hash; only after the email sends successfully does it replace the current hash and set status to resent. If sending fails, the staged hash is cleared so the recipient’s previous active link remains valid.

Other Request Protections Still Apply

Possessing a valid token is not the only condition for account creation. QCFUM checks the Invite Link status and expiration, re-resolves the linked Profile and Invite Pack, applies current tier availability and account-creation safeguards, and uses normal Joomla/session authorization protections for staff-side POST actions.

Handle Invite Links Safely

  • Do not paste active Invite Links into public tickets, screenshots, or shared documentation.
  • Use QCFUM Send Invite and Nudge/Resend rather than extracting token values from storage.
  • Cancel an Invite Link if its recipient or delivery channel is no longer trusted.
  • If a resend fails, do not assume the old link was invalidated; QCFUM intentionally preserves it on failed delivery.

Community Discussion

Want to compare Joomla user-onboarding workflows, share practical QCFUM tips, or discuss how other administrators use this feature? Visit the QC Frontend User Manager Community. For private support, bug reports, account-specific entitlement problems, or feature requests, use the QuantaCade support system.