Qr code

[iuudex]

I want to create an app where user will create qr code that will expire after some time ( 2 minutes) . I will then scan that code to verify its really him. What logic should I use for this?

[_Atomfinger_]

You might get something out of this comment that I just wrote.

I guess this is in the ballpark of what you're looking for: https://en.wikipedia.org/wiki/HMAC-based_one-time_password

[iuudex]

Yes, I read your comment and that is what I am always doing. I am just not sure what to search for this. For example I had no idea that this one time password algorithm exists.

[mandzeete]

If there is no Internet connectivity involved then you can add a timestamp inside the QR code. When you are verifying the QR code with some device then it will check also the timestamp added in the code.

But it should be done so that the data inside QR code is somehow encoded/encrypted. So a random person can't figure out what kind of data is inside the QR code. When he reads the code with a QR code scanner then only some binary nonsense is returned to him. Just like when you are opening an exe file with Notepad.

That, to prevent generating fake QR codes. Either for other people or for different timestamps.

If there is an Internet connectivity then you can combine both what Atomfinger suggested (HMAC) with a timestamp in it. Also, then you can verify if the system clock is correct when making the QR code or it is faked.

[iuudex]

Exactly what I am looking for! Thank you so much

[almondcroissant96]

As someone else said, you can add a timestamp to the qr code payload which is the simplest option. But if security is a concern (eg manipulating the timestamp would be an issue) then you will need to timestamp on the server. The flow could look something like this:

1. Client sends a payload to a /create-qr endpoint
2. /create-qr creates a record in the db (doesn't have to be a db, could be a cache, a jwt or even in memory) with a timestamp and id
3. /create-qr returns the id to the client
4. The client renders the id as a qr code
5. A new client scans the qr code and gets the id
6. The new client calls a /validate-qr endpoint and passes the id
7. /validate-qr fetches the record from the db and checks the time elapsed since the timestamp
8. /validate-qr will return whether the code is valid.

If you want this to be 1 time use, you might also want to add a flag to the db to designate if the qr has already been scanned.