QCUI - Security, Handoff Tokens & Session Isolation

Understand QCUI's security model, Super User enforcement, one-time token generation and hashing, expiration and replay prevention, CSRF protections, response headers, session forking, identity switching, MFA handling, and Shared Sessions restriction.

Articles
Title	Published Date	Author
Why QCUI Stores Only a SHA-256 Hash of the Handoff Token Why QCUI Stores Only a SHA-256 Hash of the Handoff Token in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and support guidance.	September 27, 2026	QuantaCade
How Atomic One-Time Token Consumption Prevents Replay How Atomic One-Time Token Consumption Prevents Replay in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and support guidance.	September 27, 2026	QuantaCade
How Handoff Token Expiration Works How Handoff Token Expiration Works in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and support guidance.	September 27, 2026	QuantaCade
How a Short Token Lifetime Reduces Handoff Risk How a Short Token Lifetime Reduces Handoff Risk in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and support guidance.	September 27, 2026	QuantaCade
Why the Issuing Administrator Is Revalidated at Consumption Time Why the Issuing Administrator Is Revalidated at Consumption Time in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and suppor.	September 27, 2026	QuantaCade
Why the Target User Is Revalidated at Consumption Time Why the Target User Is Revalidated at Consumption Time in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and support guidance.	September 27, 2026	QuantaCade
How QCUI Uses Joomla CSRF Protection for Start and End Actions How QCUI Uses Joomla CSRF Protection for Start and End Actions in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and support.	September 27, 2026	QuantaCade
How QCUI Uses No-Store and No-Cache Response Headers How QCUI Uses No-Store and No-Cache Response Headers in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and support guidance.	September 27, 2026	QuantaCade
Why QCUI Sends a No-Referrer Policy During Handoff Operations Why QCUI Sends a No-Referrer Policy During Handoff Operations in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and support g.	September 27, 2026	QuantaCade
How Joomla Session Forking Separates the Frontend Identity How Joomla Session Forking Separates the Frontend Identity in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and support guid.	September 27, 2026	QuantaCade
Why QCUI Removes Old Session Metadata When Switching Identities Why QCUI Removes Old Session Metadata When Switching Identities in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and support.	September 27, 2026	QuantaCade
How QCUI Maintains Joomla Frontend Login State During Impersonation How QCUI Maintains Joomla Frontend Login State During Impersonation in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and sup.	September 27, 2026	QuantaCade
How QCUI Handles the Target User's MFA Requirement How QCUI Handles the Target User's MFA Requirement in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and support guidance.	September 27, 2026	QuantaCade
Why QCUI Refuses to Run with Joomla Shared Sessions Enabled Why QCUI Refuses to Run with Joomla Shared Sessions Enabled in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and support gui.	September 27, 2026	QuantaCade
How QCUI Enforces Joomla Super User Authorization How QCUI Enforces Joomla Super User Authorization in QC User Impersonation 1.0.03, with current Joomla workflow, security, session, and support guidance.	September 27, 2026	QuantaCade

Page 1 of 2