verify.cowin.gov.in

[shailesh]

Can I know the working of this or any supporting doc. As per my understanding listing a few points below.

1. • BASE URL : https://verify.cowin.gov.in/
2. • Above URL opens up a web page with a button to click and scan
3. • The scanner then captures the image from live scanning video
4. • From the scanned image the user information is parsed and an event is raised.
5. • Then the parsed data is sent to an API for verification [https://verify.cowin.gov.in/divoc/api/v1/certificate/revoked]

All this process happens inside the webpage/client-side [the parsing of data from a video/image; no API calls for this as such], later this data is sent for verification.

[tejash-jl]

You can check the steps to be followed to extract certificate info from QRcode:

1. Scan QR code data and decompress
   https://github.com/egovernments/DIVOC/blob/india/verification/src/components/VerifyCertificate/index.js#L19
2. Verify the json object
   https://github.com/egovernments/DIVOC/blob/india/verification/src/components/CertificateStatus/index.js#L72

[adventuretrail]

In addition to the question: What I also noticed is that the revocation API end point contains few other information, which are not displayed in certificate verifier's screen, but are associated with the certificate holder. Is that with the intention of keeping data privacy in mind ? If yes, would it also make sense to prevent that data as part of the QR. Since it is quite simple for the person who verifies cert., to put Intercepting Proxy and read other fields, which are not visible currently.

Adding under same question & Not starting new Issue.

Keep up the good work.
@dileepbapat @tejash-jl @pramodkvarma & others from DIVOC.

[dileepbapat]

Verifier screen shows necessary information for tracking / identifying the dose of vaccination. For example certificate id which need not be known by beneficiary since there is beneficiary id which is good enough to track. Sensitive personal information like dob etc is not included in the certificate / QR.

Revocation API takes the complete payload from the QR code as input.

[adventuretrail]

Thanks @dileepbapat, yes that clarifies. Which means Cowin would be making QR with some possible sensitive information like UHID (but not DoB as you mentioned).

[Souravgithub1999]

How to decode the value get after scanning the QR code? @shailesh @dileepbapat @tejash-jl @adventuretrail @pramodkvarma

[pramodkvarma]

Are you asking for Co-WIN (India) implementation? If so, see https://verify.cowin.gov.in/ and at the end of that page there is a link to the source code repo for verification web app. That repo has code to unzip the scanned data, verify signature, and show results. You can look through the code.