✨ QRCode API

[rezk2ll]

feature

• requests a new access_token using SSO and matrix
• generates an SVG image containing the access_token and a magic link to the mobile application.

Prerequisites

the user must be connected
the web auth cookie must be included in the request: ie lemonldap

example:

twake.chat://login?access_token=123456

closes linagora/twake-on-matrix#1764

demo

API using Postman

qrcode decode using mobile ( without mobile magic link )

Screenrecorder-2024-10-08-11-55-51-892.mp4

[guimard]

Hi @rezk2ll : which access_token do you display here ? Remember that an access token owns to only one device

[hoangdat]

hi @rezk2ll , what kind of token in QR code?

[hoangdat]

hi @rezk2ll , we want to generate QR code ourselves. Which endpoint we need to use?

[rezk2ll]

hi @rezk2ll , we want to generate QR code ourselves. Which endpoint we need to use?

Hello @hoangdat ,

the endpoint is /_twake/v1/qrcode

More details on the swagger docs here
https://linagora.github.io/ToM-server/#/QR%20Code/get__twake_v1_qrcode

It requires the lemonldap cookie to be present in the request.

The endpoint is available in staging

[rezk2ll]

hi @rezk2ll , what kind of token in QR code?

it is an access_token obtained from matrix using the /_matrix/client/v3/login endpoint

[hoangdat]

the endpoint is /_twake/v1/qrcode

But we only need the token, we want to generate our QR code from our self, to put it to our component view

[rezk2ll]

the endpoint is /_twake/v1/qrcode

But we only need the token, we want to generate our QR code from our self, to put it to our component view

The endpoint returns a ready SVG image that can be rendered freely on the front end.

do you want an endpoint to return only a new access_token?

like /_twake/v1/access_token ?

[hoangdat]

hi @guimard , what do you think it is security issue if access_token stay in QR code?
From my point of view, any scanner can scan it and extract it, it is a huge risk.

[guimard]

Hi, there is a risk when QR code is displayed.
The best would be to follow Whatsapp way : the QR code has to be scanned from a valid device to validate new device but it's harder to build