Extract the JSON payload from SHC QR codes (i.e Québec Covid Vaccination QR Codes)
🚩 L'objectif de ce projet est le décodage des SHC. S'il vous plait, ne me sollicitez pas pour générer des codes QR personnalisés à partir d'un fichier JSON. Cela ne fonctionnera pas car la signature des codes QR personnalisés ne sera pas vérifiée par les applications de validation officielles
🚩The purpose of this project is SHC decoding. Please do not ask me to generate custom QR codes from a JSON file. It won't work since the signature of custom QR codes won't be accepted by official validation apps.
For more information please refer to FAQ about shc-extractor.
Plusieur provinces et territoires canadien ont mis en place un système passeport vaccinal utilisant une preuve de vaccaination numérique (le fameux code QR) afin de luter contre la propagation de la COVID-19. Ces codes QR sont généré avec le protocole Smart Health Cards (https://smarthealth.cards), fonctionnant l'aide de JWT (un système de jeton numérique généralement utilisé pour l'authentification d'APIs qui permet d'empêcher la falcification des codes QR). En bref, toutes les données de la preuve de vaccination sont directement encodées en JSON dans le contenu du code QR, puis signées avec une clé secrète. Cela permet par la suite de valider l'authenticité des données d'un code QR sans qu'il soit nécessaire de conserver une copie des données relatives aux personnes vaccinées sur un quelconque serveur. Or, puisque les données sont disponible dans le payload du code QR, il est possible d'extraire ces données afin de les consulter et de verifier leur authenticité.
Several Canadian provinces and territories have introduced a vaccination passport system using digital proof of vaccination (the infamous QR code) to help prevent COVID-19 spread. These QR codes are generated through the Smart Health Cards protocol (https://smarthealth.cards), using JWT (a digital token system generally used for Web API authentication, that prevents QR code forgery). In short, all the relevant immunization data will be directly encoded as JSON in the QR code payload, and then signed with a secret key. This allows to validate the authenticity of the QR code data without the need to keep a copy of the vaccination data on any server. Since the data is available in the QR code payload, it is possible to extract this data in order to review it and verify its trustworthiness.
SHC-extractor now supports QR codes decoding for the following provinces and territories :
FR :
EN :
git clone https://github.com/obrassard/shc-extractor.git
cd shc-extractor
npm install
node shc.js '/path/to/the/qrcode.png'
Where '/path/to/the/qrcode.png'
is a path to the QR Code image (in PNG).
The extracted JSON will be saved in ./out
Why reading a JSON file when you can visualize your QR code data in a cute Web UI?
How ?
GET {host}/card?shc={shc-raw-content}
You can try it with the sample QR code (or your own) on the live demo page : https://shc.obrassard.ca (no data is collected or stored by this server). On the main page, you'll be prompted to scan a QR code to decode.
:bulb: Tip : If you have an iOS device, you can also use this shortcut to scan the QR code and quickly open the Web UI : https://www.icloud.com/shortcuts/435d6706c43e45e4a9b78e700bdfcdf8
If you prefer you may use it locally using the following commands :
npm install
npm start
# Then navigate to :
GET http://localhost:1234/
Note that some browsers may not let you access the camera if you are not using https.
https://github.com/dvci/health-cards-walkthrough/blob/main/SMART%20Health%20Cards.ipynb
https://gist.github.com/remi/e3aa2f78845ee13f706ed83aead5145f
Special thanks to @fproulx, who found the public key that allows validation of Qc Gov. QR Codes.
./sample/sample-qr-code.png :
Extracted data :
node shc.js './sample/sample-qr-code.png'
{
"header": {
"zip": "DEF",
"alg": "ES256",
"kid": "3Kfdg-XwP-7gXyywtUfUADwBumDOPKMQx-iELL11W9s"
},
"payload": {
"iss": "https://smarthealth.cards/examples/issuer",
"nbf": 1620847989.837,
"vc": {
"type": [
"https://smarthealth.cards#health-card",
"https://smarthealth.cards#immunization",
"https://smarthealth.cards#covid19"
],
"credentialSubject": {
"fhirVersion": "4.0.1",
"fhirBundle": {
"resourceType": "Bundle",
"type": "collection",
"entry": [
{
"fullUrl": "resource:0",
"resource": {
"resourceType": "Patient",
"name": [
{
"family": "Anyperson",
"given": [
"John",
"B."
]
}
],
"birthDate": "1951-01-20"
}
},
{
"fullUrl": "resource:1",
"resource": {
"resourceType": "Immunization",
"status": "completed",
"vaccineCode": {
"coding": [
{
"system": "http://hl7.org/fhir/sid/cvx",
"code": "207"
}
]
},
"patient": {
"reference": "resource:0"
},
"occurrenceDateTime": "2021-01-01",
"performer": [
{
"actor": {
"display": "ABC General Hospital"
}
}
],
"lotNumber": "0000001"
}
},
{
"fullUrl": "resource:2",
"resource": {
"resourceType": "Immunization",
"status": "completed",
"vaccineCode": {
"coding": [
{
"system": "http://hl7.org/fhir/sid/cvx",
"code": "207"
}
]
},
"patient": {
"reference": "resource:0"
},
"occurrenceDateTime": "2021-01-29",
"performer": [
{
"actor": {
"display": "ABC General Hospital"
}
}
],
"lotNumber": "0000007"
}
}
]
}
}
}
},
"verifications": {
"trustable": true,
"verifiedBy": "3Kfdg-XwP-7gXyywtUfUADwBumDOPKMQx-iELL11W9s"
}
}