Why QCUI Sends a No-Referrer Policy During Handoff Operations

Why QCUI Sends a No-Referrer Policy During Handoff Operations is a deliberate QCUI 1.0.03 behavior that protects administrator access, target-account safety, or the integrity of the one-time impersonation handoff.

Privacy boundary

QCUI sets Referrer-Policy: no-referrer on handoff-related responses so the browser does not send the sensitive handoff page URL/context as a Referer header during navigation.

Combined with other controls

No-referrer complements no-store/no-cache, one-time token consumption, short expiration, hash-at-rest storage, and the POST-based consume flow. It is not the only protection around the handoff.

Administrator practice

Do not copy the raw handoff token into tickets or messages. If a handoff fails, issue a new one rather than trying to preserve or share the old secret.

Security boundary

The controls described for Why QCUI Sends a No-Referrer Policy During Handoff Operations are complementary. Super-User authorization does not make a reusable token safe; a one-time token does not make Shared Sessions safe; and a visible banner does not make state-changing customer actions harmless. Preserve the complete 1.0.03 security model rather than removing individual checks for convenience.

Community Discussion

Want to compare support workflows, share practical tips, or discuss how you use this QCUI feature? Visit the QC User Impersonation Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.