search

ActiveLogin / ActiveLogin.Authentication

Support Swedish BankID (svenskt BankID) authentication in .NET. Unofficial package, not created by BankID.
https://activelogin.net
MIT License
214 stars 74 forks source link

Generate the QR-code on the client using Javascript #394

Open PeterOrneholm opened 1 year ago

PeterOrneholm commented 1 year ago

Is your feature request related to a problem? Please describe. Right now we are generating the QR-code serverside by implementing IBankIdQrCodeGenerator, by default that is done using the QRCoder library. The interface expects you to return the generated QR code as a Base64 encoded PNG-file that is then transported to the client and displayed to the user.

As the image is refreshed quite often (every second) this could cause timing issues (as the QR-code only have a limited lifespan, it is important that it reaches the client right on time). We should look at having the possibility (and make that the default option) to just return the content for the QR code and then tender it on the client using some kind of JS-lib.

What area is it related to UI

Describe the solution you'd like Change the IBankIdQrCodeGenerator so that it, in addition to the content, also returns some content type (png/svg etc). Then make the server side rendering optional, set it as an option. Either way, the raw content of the QR code should always be sent to the client to allow for it to render the code itself.

A few ideas on JS lib can be found here: https://medium.com/geekculture/few-ways-to-generate-qr-code-using-javascript-54b6b5220c4f

We would need to think about how to solve this, without taking a hard dependency on a third party lib.

TimNilimaa commented 5 months ago

So this was removed from the v9 release not that long ago, but I would argue this is still an important change for stability. One would have to look at a hard dependency vs inventing the wheel and having to support that code too...

PeterOrneholm commented 5 months ago

It is still a thing we would like to prioritize, but we have had (as you have noticed) to move it forward in our backlog as other things have become more urgent / sponsored by clients. We are up for contributions (both code and sponsorship) if you would like this feature to be implemented faster :)

TimNilimaa commented 5 months ago

Sorry, the comment was more clear in my head I guess. I just wanted to make sure that it is still valued to do and would like to start the discussion regarding doing QR generation from scratch OR to take in a dependency before doing anything that is not accepted in a PR.

PeterOrneholm commented 5 months ago

Ah, sorry, I misunderstood it :)

I would be very much up for having a dependency on a third party library client side, but would like it to be pluggable in case companies have preferences (because of security, license etc). We should make the default flow easy, with the possibility to swap it. Embedding such third party library into the NuGet package would be the best for the end user, but would require us to think about licensing (as we would redistribute the actual library).

I see no reason to continue support server side generated QR-codes, but the configuration of it could/should be done from the serverside. I think we should follow the pattern of having a separate library for the "wrapper" of the library (as we do for QRCOder today). We could then let that NuGet package embed and expose the library as well as some javadscript code that would fit into the main javascript client side code.

Please try to write down your ideas / concept before implementing a PR :)