Why QCUI Opens the Impersonated Frontend in a New Browser Tab

Why QCUI Opens the Impersonated Frontend in a New Browser Tab is a deliberate QCUI 1.0.03 behavior that protects administrator access, target-account safety, or the integrity of the one-time impersonation handoff.

Current behavior

Why QCUI Opens the Impersonated Frontend in a New Browser Tab belongs to QCUI’s administrator launcher and handoff creation. In 1.0.03, the implementation is intentionally narrow: an authenticated Super User starts an explicit one-time handoff, QCUI validates the target, and only the separate Joomla frontend session is switched.

Relevant safeguards

  • Super-User-only initiation: QCUI requires Joomla core.admin on the issuing identity.
  • Shared Sessions refusal: QCUI stops rather than risk replacing the administrator identity when Joomla is configured to share site/admin sessions.
  • Short-lived one-time token: configurable 30–300 seconds, 60 seconds by default, with atomic single-use consumption.
  • Hashed-at-rest secret: only the SHA-256 token hash is stored in the database.
  • Double validation: administrator authority and target eligibility are checked again at consumption time.
  • CSRF and cache controls: start/end actions use Joomla tokens; handoff responses are no-store/no-cache with a no-referrer policy.
  • Session isolation: the frontend session is forked instead of replacing the existing administrator session.

Practical verification

When validating Why QCUI Opens the Impersonated Frontend in a New Browser Tab, confirm the behavior against the actual Joomla account/session state rather than assuming QCUI grants new permissions. QCUI respects Joomla core.admin, core.login.site, block/reset flags, Shared Sessions, form tokens, and the normal session handler.

Community Discussion

Want to compare support workflows, share practical tips, or discuss how you use this QCUI feature? Visit the QC User Impersonation Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.