The Google Graph API URI is a bad idea. about otphp HOT 4 CLOSED

The use of Google Graph is not mandatory. It is just an easy way to configure applications.
Moreover the call is over HTTPS (https://chart.googleapis.com) so the possibility for a QRCode to be leaked should be limited.

The library allows you to define your own QRCode generator. This generator can be hosted by your own servers.
If you prefer, you can just send the provisioning Uri to your client that will render the QRCode for you (e.g. using https://davidshimjs.github.io/qrcodejs/)

from otphp.

Well I think that at least, the docs should be updated to mention that it's useful for development but poses a risk in production. An outside server/network shouldn't be trusted with the secrets for your application.

from otphp.

Hi,

v9.0 will be release by the end of June.
This issue will be taken into account. See #72 for more information or if you have comments/suggestions.

Regards.

from otphp.

Done. See #72.

Thank you.

from otphp.