QR Code Generator Introduction
A QR code often carries data that should not leave the company: an internal link, a phone number, the password of a guest network. Before a tool for such codes is allowed on the intranet, an administrator wants to know where this data goes. This article answers the question for QR Code Generator: where the code is built, what the solution is permitted to do, where the entered data is stored and which requests the web part sends outside the tenant.
Summary for administrators
| Question | Answer |
|---|---|
| Where is the QR code generated? | In the browser of the user |
| Is the encoded data sent to Vitextra or to a third party? | No |
| Which API permissions does the package request? | None |
| Does the web part read SharePoint lists, files or user profiles? | No |
| Where is a saved configuration stored? | In the properties of the web part, inside the SharePoint page |
| Who can read a saved configuration? | Everyone who can open the page |
| What is sent to Vitextra services? | Technical identifiers for the license check and usage telemetry; no content of the codes |
The code is generated in the browser
The web part turns the entered data into a QR code with a script that runs in the browser. The data from the fields is not sent to a server to be encoded, and the image is drawn on the device of the user. Download and Copy work in the browser as well: the file is created locally and goes to the downloads folder or to the clipboard.
Permissions of the solution
QR Code Generator is a SharePoint Framework web part that is deployed from the app catalog.
- The package requests no API permissions. Nothing appears for approval on the API access page of the SharePoint admin center, and the web part does not call Microsoft Graph.
- The web part does not read or change lists, libraries, files or user profiles. From the page it takes only the address of the current site, to pre-fill the URL field.
- The uploaded logo is not saved to a library: it is kept inside the configuration of the web part.
What users need
| Task | Required permission |
|---|---|
| Upload the package to the app catalog | SharePoint administrator, or owner of the app catalog |
| Add the web part to a page, save a prepared code | Edit permission on the page |
| See the prepared code, make, copy and download codes | Read permission on the page |
Where a saved configuration is stored
When a page with the web part is edited and saved, the whole configuration of the generator is saved with it: the values of the fields on all data tabs, the design, the logo and the size. Technically it is one of the properties of the web part, stored inside the page in the Site Pages library of the site.
Three consequences follow.
The data is stored as plain text. The configuration is not encrypted. The fields, including Password on the Wi-Fi tab, are shown as ordinary text next to the code.
The permissions of the page are the permissions of the data. Everyone who can open the page can read everything that is saved in the web part. The web part has no settings that hide the fields from readers.
Previous versions are kept. SharePoint keeps the version history of a page. A password that was saved in the web part and later replaced remains in the earlier versions of the page, available to those who can view the version history.
❗ Important
Do not save the passwords of corporate networks or other secrets in the web part. Use it for data that the whole audience of the page is allowed to know, such as the password of a guest network on a page for employees.
Data that a visitor enters on a published page without editing it is not stored anywhere. It exists in the browser until the page is closed or reloaded.
Requests to Vitextra services
The web part contacts services outside the tenant for three purposes. None of the requests contains the data entered into the generator or the generated code.
| Purpose | What is sent | Where |
|---|---|---|
| License check | The tenant ID, the ID of the user account in Microsoft Entra ID, the address of the site, the identifier, name and version of the product | vitextra.com |
| Usage telemetry | An event when the web part is loaded: the product name and version, the ID and address of the site, the ID of the user account, the language of the interface and whether the web part runs in Teams | Azure Application Insights |
| Loading the product files | Nothing but an ordinary request for a file: the scripts of the web part and its icons are downloaded from the Vitextra content delivery network | static.vitextra.com, vitextra-storage.azureedge.net |
The user is identified in these requests by the ID of the account — a GUID — and not by name or email address.
📝 Note
If your organization restricts outbound connections, allow the hosts listed above. Without access to the content delivery network the web part cannot load. The processing of data by Vitextra is described in the Privacy Policy.
What is inside a QR code
A QR code is not protected in any way. It contains the data itself, and any scanner shows it. Three things are worth remembering:
- a code with a password is as confidential as the password — whoever has a photo of the code has the password;
- a code does not expire and cannot be revoked. To make a printed code useless, change what it points to: the password of the network, the address of the page;
- a code with an internal link opens only for people who have access to the linked page; the code itself reveals only the address.
Recommendations
- Publish codes with sensitive data on pages whose audience matches the audience of the code, and check the permissions of the page before publishing.
- Use the Wi-Fi tab for guest networks only, and renew the code when the password is changed.
- Before publishing, clear the fields of the tabs that are not used — their values are saved too.
- Where a link is enough, prefer the URL tab with a link to a protected page over a code that carries the data itself.
Summary
QR Code Generator builds the code in the browser, needs no API permissions and reads nothing from SharePoint. The only place where the entered data is kept is the page on which an editor saves it, and there the data is as open as the page is.
💡 Tip
How a prepared code is saved and what the visitors of the page see is described in KB10269. Publishing a Preconfigured QR Code on a SharePoint Page.