Extract and validate the JSON payload from SHC QR Codes (i.e Québec COVID Vaccination QR Codes)
Bientôt, le gouvernement du Québec mettra en place un passport vaccinal utilisant la preuve de vaccaination numérique (le fameux code QR). Ces codes QR sont généré avec le protocole Smart Health Cards (https://smarthealth.cards), fonctionnant l'aide de JWT (un système de jeton numérique généralement utilisé pour l'authentification d'APIs qui permet d'empêcher la falcification des codes QR). En bref, toutes les données de la preuve de vaccination sont directement encodées en JSON dans le contenu du code QR, puis signées avec une clé secrète. Cela permet par la suite de valider l'authenticité des données d'un code QR sans qu'il soit nécessaire de conserver une copie des données relatives aux personnes vaccinées sur un quelconque serveur. Or, puisque les données sont disponible dans le payload du code QR, il est possible d'extraire ces données afin de les consulter et de verifier leur authenticité.
Soon, the Quebec government will deploy a vaccination passport using the digital proof of immunization (the infamous QR code). These QR codes are generated through the Smart Health Cards protocol (https://smarthealth.cards), using JWT (a digital token system generally used for Web API authentication, that prevents QR code forgery). In short, all the relevant immunization data will be directly encoded as JSON in the QR code payload, and then signed with a secret key. This allows to validate the authenticity of the QR code data without the need to keep a copy of the vaccination data on any server. Since the data is available in the QR code payload, it is possible to extract this data in order to review it and verify its trustworthiness.
FR :
- Ce projet n'est pas affilié au Gouvernement du Québec.
- Cette application est destinée à des fins éducatives et ne fournit aucune garantie, y compris concernant la validation des données.
- Cette application ne doit pas être utilisée pour recueillir des données personnelles sans le consentement du propriétaire des données. De plus, elle n'est pas destinée à des fins de vérifications des preuves de vaccination dans le cadre de l'application de la loi sur le passeport vaccinal au Québec. Les commerçants doivent utiliser l'application officielle VaxiCode Verif pour valider les codes QR.
- Le développeur de cette application se détache de toute responsabilité lié à un usage illégal de l'application par une tierce personne.
EN :
- This project is not affiliated with the Government of Quebec.
- This app is intended for educational purposes and do not provide any warranty of any kind including data validation.
- This application should not be used to collect personal data without the consent of the data owner. Furthermore, it cannot be used for verifying proof of vaccination in the context of the law on vaccination passports in the Province of Quebec. Merchants must use the official application VaxiCode Verif to validate QR codes.
- The developer of this application disclaims any responsibility for illegal use of the application by a third party.
git clone https://github.com/obrassard/shc-extractor.git
cd shc-extractor
npm install
node shc.js '/path/to/the/qrcode.png'
Where '/path/to/the/qrcode.png' is a path to the QR Code image (in PNG).
The extracted JSON will be saved in ./out
Why reading a JSON file when you can visualize your QR code data in a cute Web UI?
How ?
GET {host}/card?shc={shc-raw-content}
You can try it with the sample QR code (or your own) on the live demo page : https://shc.obrassard.ca/card (no data is collected or stored by this server).
💡 Tip : If you have an iOS device, you can use this shortcut to scan the QR code and quickly open the Web UI : https://www.icloud.com/shortcuts/435d6706c43e45e4a9b78e700bdfcdf8
If you prefer you may use it locally using the following commands :
npm install
npm start
# Then navigate to :
GET http://localhost:1234/card?shc=5676290...
-
https://github.com/dvci/health-cards-walkthrough/blob/main/SMART%20Health%20Cards.ipynb
-
https://gist.github.com/remi/e3aa2f78845ee13f706ed83aead5145f
-
Spcial thanks to @fproulx, who found the public key that allows validation of Qc Gov. QR Codes.
./sample/sample-qr-code.png :
Extracted data :
node shc.js './sample/sample-qr-code.png'
{
"header": {
"zip": "DEF",
"alg": "ES256",
"kid": "3Kfdg-XwP-7gXyywtUfUADwBumDOPKMQx-iELL11W9s"
},
"payload": {
"iss": "https://smarthealth.cards/examples/issuer",
"nbf": 1620847989.837,
"vc": {
"type": [
"https://smarthealth.cards#health-card",
"https://smarthealth.cards#immunization",
"https://smarthealth.cards#covid19"
],
"credentialSubject": {
"fhirVersion": "4.0.1",
"fhirBundle": {
"resourceType": "Bundle",
"type": "collection",
"entry": [
{
"fullUrl": "resource:0",
"resource": {
"resourceType": "Patient",
"name": [
{
"family": "Anyperson",
"given": [
"John",
"B."
]
}
],
"birthDate": "1951-01-20"
}
},
{
"fullUrl": "resource:1",
"resource": {
"resourceType": "Immunization",
"status": "completed",
"vaccineCode": {
"coding": [
{
"system": "http://hl7.org/fhir/sid/cvx",
"code": "207"
}
]
},
"patient": {
"reference": "resource:0"
},
"occurrenceDateTime": "2021-01-01",
"performer": [
{
"actor": {
"display": "ABC General Hospital"
}
}
],
"lotNumber": "0000001"
}
},
{
"fullUrl": "resource:2",
"resource": {
"resourceType": "Immunization",
"status": "completed",
"vaccineCode": {
"coding": [
{
"system": "http://hl7.org/fhir/sid/cvx",
"code": "207"
}
]
},
"patient": {
"reference": "resource:0"
},
"occurrenceDateTime": "2021-01-29",
"performer": [
{
"actor": {
"display": "ABC General Hospital"
}
}
],
"lotNumber": "0000007"
}
}
]
}
}
}
},
"verifications": {
"trustable": true,
"verifiedBy": "3Kfdg-XwP-7gXyywtUfUADwBumDOPKMQx-iELL11W9s"
}
}