PCR-Test QR-code invalid (QR-Code ist ungültig)

[DannySchumann]

Avoid duplicates

• Bug is not mentioned in the FAQ
• Bug is specific for Android only, for general issues / questions that apply to iOS and Android please raise them in the documentation repository
  • not sure about this.
• Bug is not already reported in another issue

Describe the bug

After scanning the QR-Code from an official Corona-Warn-App paper from the doctor the app shows the error: "QR-Code ist ungültig".

Expected behaviour

The app should accept the QR-Code.

Steps to reproduce the issue

1. Click on "Wurden Sie getestet?"
2. Click on "Weiter"
3. Click on "Dokument mit QR-Code"
4. Cllick on Einwilligungserklärung "Erlauben"
5. Accept that the warn app can access the camera "ZULASSEN"
6. Scan the QR-Code

Technical details

• Mobile device: Huawei P10 lite
• Android version: 8

Possible Fix

I don't know if it is an issue of the app, backend or any other part of the process.

Additional context

• The QR-Code was NOT scanned from another phone.
• The QR-Code was from an official piece of paper which explicitly meantioned the Corona-Warn-App.
• The FAQ: https://www.coronawarn.app/de/faq/#qr_test doesn't help:
  In einigen Fällen kann es vorkommen, dass Sie einen QR-Code erhalten haben, der nicht mit dem Testabrufsystem der Corona-Warn-App kompatibel ist bzw. nicht für den Abruf des Tests freigeschaltet wurde. What does "nicht für den Abruf des Tests freigeschaltet" mean? Who has to do this?

---

Related to: corona-warn-app/cwa-documentation#400.

Internal tracking ID: EXPOSUREAPP-2403
Internal tracking ID: EXPOSUREAPP-3546 extra slash

[MikeMcC399]

Hi @DannySchumann

There is a hot topic open on this issue under corona-warn-app/cwa-documentation#400.

"nicht für den Abruf des Tests freigeschaltet" refers to processing of the checkbox on the form shown in corona-warn-app/cwa-documentation#400 (comment) "Das Einverständnis des Versicherten zum Übermitteln des Testergebnisses für Zwecke der Corona-Warn-App auf den vom RKI betriebenen Server wurde erteilt. Dem Versicherten wurden Hinweise zum Datenschutz ausgehändigt."

Did you get tested at a doctor's practice or by the health authority (Gesundheitsamt)?
The form is slightly different for the Gesundheitsamt, where it replaces "Versicherten" with "Getesteten" in the above text. It also uses the different term at the top of the form with the QR code you should have received, where it says Name, Vorname des ...... (I'm just going by the information on https://www.kbv.de/html/1150_46778.php by the way.)

Good luck for the result of your test anyway!

[DannySchumann]

Dear Mike, i am reporting on behalf of someone else.
The test was done at the doctor's practice.
Do one need to wait until the test was received by the laboratory before the code can be scanned? This is not mentioned anywhere, so i expect one is able to scan the code regardless of what checkbox is filled on a piece of paper which cannot be known by the system at scan-time.
The upper part of the form was filled by the docter.
Has the doctor to register the code in the system before handing it out?

[thomasaugsten]

Hi
there is no wait for the laboratory you can scan the test immediately. You can also scan the code regardless of the checkbox.
This error appears when the QR Form was copied and not newly generated or it is not a valid QR Code for the CWA because of a mistake of the creator.
Can you provide me a photo of the QR code via email?

[DannySchumann]

I sent the QR-Code to @thomasaugsten and now waiting for feedback.

[MikeMcC399]

@DannySchumann

I sent the QR-Code to @thomasaugsten and now waiting for feedback.

Thanks for keeping us updated! It will be interesting to hear what was causing the problem scanning the QR code.

I re-read the full FAQ article Probleme mit dem QR-Code that you referred to and I realized that the text part that you quoted wasn't describing your problem, but instead was related to a problem after a QR code has been successfully scanned. So I made a suggestion in corona-warn-app/cwa-website#549 about making the FAQ article easier to understand.

Edit: There is now a new article https://www.coronawarn.app/en/faq/#qr_scan "I get an error while scanning the QR code. What can I do?" which deals only with scanning issues to make it clearer.

[DannySchumann]

The feedback from @thomasaugsten was that:

• The CR-Code was wrong generated
• It is known that wrong generated QR-Codes are out there
• App version 1.6 should accept these wrong generated QR-Codes (so this is also an App issue)

I think it is not acceptable that affected practices are not informed about that issue and that they handing out wrong QR-Codes every day. It should be also mentioned in the FAQs that there is the possibility of wrong generated codes at all.

Anyhow i appreciate the quick feedback of @thomasaugsten.

[ascherp]

The feedback from @thomasaugsten was that:

* The CR-Code was wrong generated

* It is known that wrong generated QR-Codes are out there

* App version 1.6 should accept these wrong generated QR-Codes (so this is also an App issue)

I think it is not acceptable that affected practices are not informed about that issue and that they handing out wrong QR-Codes every day. It should be also mentioned in the FAQs that there is the possibility of wrong generated codes at all.

Anyhow i appreciate the quick feedback of @thomasaugsten.

Version 1.6.1 on Samsung S 10+ with latest Android still has this issue. There is also no new version 1.7 in the Google Store (I saw somewhere on the CWA-Github that there is a new version).

The GP says that some codes only become "visible" after they have been processed by the labs. They also say that they have quite a lot of calls where people report the same issue.

Can you confirm that version 1.6.1 still has not resolved the issue, and/or post a work-around until the issue resolved?

A

[thomasaugsten]

This issue can have multiple reasons. Wrongly generated QR Codes, photocopied QR Codes our try to scan this more than once.

All QR codes are valid you will receive a result when the qr code have been processed by a test lab.

[ascherp]

Hi Thomas I can confirm that it can only be a wrongly generated qr code. The cases "photocopy" and "multiple scans" can be excluded - both don't apply here. In some other post, I saw the issue is capitalization of letters. Is this still an issue? Here are the prefixes: https://localhost//?AD1ED0-... <https://localhost//?AD1ED0-BEBEEB0B-17C2-48E3-B0B1-6D323704DA63> https://localhost//?C11462-... <https://localhost//?C11462-09897507-3FCD-4894-A6E7-5185DBF14BF7> /Is there a workaround, like manually lowercasing the URL and feeding it back to CWA?// / A

…

On 27.11.20 18:49, Thomas Augsten wrote: This issue can have multiple reasons. Wrongly generated QR Codes, photocopied QR Codes our try to scan this more than once. All QR codes are valid you will receive a result when the qr code have been processed by a test lab. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1551 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AD2BQSYBOEEF55TZOGS3ZFLSR7RC7ANCNFSM4TMR4V6A>.

[MikeMcC399]

@ascherp

Here are the prefixes:

https://localhost//?AD1ED0-...

There was mention in #1514 (comment) of invalid QR codes which contained two backslash characters after the local host i.e. https://localhost//? instead of https://localhost/? like the ones you have posted.

The #1514 (comment) refers to the solution in #1524. I don't know whether the comment means that // is supposed to be accepted or not. Unfortunately I'm unfamiliar with regex. Perhaps @harambasicluka could clarify?

There is a wishlist item corona-warn-app/cwa-wishlist#227 concerning manual entry of a QR code using the alphanumeric string printed under the QR code, but that is still in status of being wished for.

[ascherp]

Thanks for the link. Indeed, the bug is very annoying as it unnecessarily delays the entire process. A good offline-tool to quick-fix the localhost// problem for yourself is to use https://wiki.ubuntuusers.de/QtQR/. In version 1.7.1 of the app, upper/lower case is not an issue anymore, but the two // after localhost are still a problem. Example, if you have https://localhost//?AD1ED0-... a tiny modification to https://localhost/?AD1ED0-... will do the trick. I have updated the solution description. A

…

On 29.11.20 11:21, Mike McCready wrote: @ascherp <https://github.com/ascherp> Here are the prefixes: https://localhost//?AD1ED0-... There was mention in #1514 (comment) <#1514 (comment)> of invalid QR codes which contained two backslash characters after the local host i.e. https://localhost//? instead of https://localhost/? like the ones you have posted. The #1514 (comment) <#1514 (comment)> refers to the solution in #1524 <#1524>. I don't know whether the comment means that // is supposed to be accepted or not. Unfortunately I'm unfamiliar with regex. Perhaps @harambasicluka <https://github.com/harambasicluka> could clarify? There is a wishlist item corona-warn-app/cwa-wishlist#227 <corona-warn-app/cwa-wishlist#227> concerning manual entry of a QR code using the alphanumeric string printed under the QR code, but that is still in status of being wished for. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1551 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AD2BQS6AWWEOD5OJ6HZPJ23SSIOCVANCNFSM4TMR4V6A>.

[dsarkar]

Dear @ascherp, @MikeMcC399,

Thanks for the detailed analysis. We will bring up the 'QR code: extra slash' issue (EXPOSUREAPP-3546) to the developers together with the suggestion corona-warn-app/cwa-wishlist#227.

Best wishes,
DS

---

Corona-Warn-App Open Source Team

[misterjupiter]

There was mention in #1514 (comment) of invalid QR codes which contained two backslash characters after the local host i.e. https://localhost//? instead of https://localhost/? like the ones you have posted.

I can confirm the bug, I had exactly the same issue as described in the bug by @DannySchumann

The error was caused by a malformed URI in the QR-code containing two slashes (not back slashes) instead of one, e.g https://localhost//?AD1ED0..., after the localhost part.

Reading the QR-Code with my camera app, copying the URI, fixing the double slash issue and generating a new QR-code with a valid URI with a single slash allowed me to scan the code within the CWA without issues and I got my result immediately.

[thomasaugsten]

@misterjupiter Can you please provide the name of the test lab via email

[misterjupiter]

@thomasaugsten:

You got mail.

[MikeMcC399]

@grimch
Taking one step back from the implementation, the spec (see #1551 (comment)) says:

Die eindeutige GUID ist nach den folgenden Vorgaben aufgebaut: -

• wird als 6-stellige hexadezimale Zufallszahl erzeugt, welche ggf. linksbündig mit 0 gefüllt werden kann.
• wird gemäß RFC4122 Version 4 mit den zugehörigen Separatoren erzeugt.

Die Zeichenkette der GUID hat folgende Form: XXXXXX-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX.

Beispiel einer erzeugten GUID: 3D6D08-3567F3F2-4DCF-43A3-8737-4CD1F87D6FDA

I couldn't see any check digit or similar mechanism to be able to validate the GUID, for input errors like transposing digits. For instance if I typed in
3D6D08-3576F3F2-4DCF-43A3-8737-4CD1F87D6FDA instead of
3D6D08-3567F3F2-4DCF-43A3-8737-4CD1F87D6FDA
it would still be valid. So the danger is that somebody types in their GUID wrongly and is then waiting for ever because the GUID does not correspond to any test.

If the incorrect QR codes were caused by a software bug in the doctor's practice or test center software which fills out the forms and prints them out, those bugs should have been fixed by now. I saw there is also a validation process for forms described in the document on https://update.kbv.de/ita-update/Blankoformulare/10C_OEGD/KBV_ITA_AHEX_Testpaket_BFB_Covid.pdf, so hopefully that process has caught any remaining errors.

Perhaps we could somehow get some feedback about how often incorrect QR codes are now being seen?

[grimch]

@MikeMcC399
The issue that got me started in the first place was not a wrongly defined GUID (e.g. with the double slash) but a faded print out which the app wasn't able to scan - it imply didn't recognize the QR-code at all.

But you are right on the other hand that a manual entry (or creating a QR-code manually via the workaround I have lined out) is error prone because there is no checksum as there is for example in an IBAN.

So may be we should allow it but give a warning to double check or an option to repeat and enter it twice.

[MikeMcC399]

@grimch

The issue that got me started in the first place was not a wrongly defined GUID (e.g. with the double slash) but a faded print out which the app wasn't able to scan - it imply didn't recognize the QR-code at all.

I remember that was in the corona-warn-app/cwa-wishlist#302 submission and you included a script workaround in corona-warn-app/cwa-wishlist#302 (comment) to generate a replacement QR code.

It would be good to hear back from the developers if they would integrate a manual GUID entry into the app if you contributed it. Perhaps just having your script workaround is a good enough compromise?

[ndegendogo]

Perhaps just having your script workaround is a good enough compromise?

Well ... there is another ticket in the wishlist that suggests a manual entry, see #227. Reason given is a broken camera (unable to scan). For this case a script to print the code again would not help.
Also not everybody has a printer and a computer to install and run the script ...

Too bad that the QR code has no checksum - but how do they then ensure that the user does not scan a QR code from a different lab system and then waits forever for their results? Does every lab system have a different format / structure so it can be distinguished?

[dsarkar]

Hi all, We will rise the topic. My understanding from your input is the following. Since QR code URLs sometimes are wrongly constructed, your mail suggestions are

• Manual hex code entry
• Script on the website to enter manually hex code, and then generating QR code image.

---

Corona-Warn-App Open Source Team

[grimch]

@grimch

The issue that got me started in the first place was not a wrongly defined GUID (e.g. with the double slash) but a faded print out which the app wasn't able to scan - it imply didn't recognize the QR-code at all.

I remember that was in the corona-warn-app/cwa-wishlist#302 submission and you included a script workaround in corona-warn-app/cwa-wishlist#302 (comment) to generate a replacement QR code.

It would be good to hear back from the developers if they would integrate a manual GUID entry into the app if you contributed it. Perhaps just having your script workaround is a good enough compromise?

It would have been a bit over-ambitious to expect, that I could walk right in and contribute some change to the actual UI.
The reason I played around with the code in my local environment was to gain some experience and also get an idea about the complexity of the change and the implementation effort required.
The figure I have come up with (and that would not be for me but someone already involved and well familiar with the code) is about three days for implementation and potential refactoring of existing code, one day for test implementation and one day for feature testing.
I am not sure if the project is running agile though and if you are doing something like planning poker. If you do may be those figures will help you if you at some point.

The more important aspect about this however is what Mike said about the risk of typing in false GUIDs and not getting a response at all.
The risk of people complaining about the latter and therefore shining a bad light on the CWA as a whole definitely outweighs the usability gain of being able to enter the GUID directly n the app. Therefore I am perfectly fine with the "Barcode-Generator" approach on the Website.

[ndegendogo]

about three days for implementation and potential refactoring of existing code

... and don't forget the implementation of Android variant

But, yes, as already mentioned above: the main effort might be upfront in discussing the details of such a solution / impact on security / and all this stuff

[srhinow]

Since our daughter doesn't have her own cell phone yet, we tried to scan 2 QR codes in a Covid app to get the test results from both people on one device. When scanning the second, the app reported that no 2 QR code scans are possible. Then we installed the app on the table to create the second PCR test there (via QR code) but there it was said that this was invalid because it was probably already created on another device.

Is that a bug or not that on the one hand it is not possible to create two tests on one device, but at the same time the second is marked as invalid although it could not be created successfully.

1st solution: If this is not possible, that two PCR tests are to be created on one device, the possibility must be hidden.
2. Solution: Only mark the certificate as invalid after successful setup

[dsarkar]

Hi @srhinow,
thanks for your question.

1. A test QR code can only be scanned once.
2. Only on PCR test QR code and one rapid test QR code be registered at the same time with the Corona-Warn-App.

See https://www.coronawarn.app/en/faq/#QRcodes.

Best wishes, DS

---

Corona-Warn-App Open Source Team

[srhinow]

But then it's a bug in the app interface. Because why is it still possible to click on it again if there is already an active PCR test set up in the app? Shouldn't every user actually have to have dealt with the FAQ beforehand?

[ndegendogo]

@srhinow is right here.
The current UI/UX is ... lets call it suboptimal.

1. as long as cwa supports only register of a single test ( = for a single person), it should not silently delete the first registration when the user scans another. Instead this deletion needs a user confirmation, and the user must be informed and warned of the consequences.

2. could you also analyse on the server side of registration if this operation could be more "transactional"? So don't "burn" a registration code on a failed attempt before the test is fully and successfully registered.

@dsarkar could you please discuss this with the devs? (app-side and server-side)

[dsarkar]

@srhinow @ndegendogo We will have a look at it. Stand by. Thanks.

[Ein-Tim]

@ndegendogo

Regarding point 1, please see corona-warn-app/cwa-wishlist#515.

[ndegendogo]

Thanks @Ein-Tim - I have upvoted it.

[mxsrm]

Today I have scanned a PCR code for CWA but the internet connection was not good. The code expired but nothing got registered in the app. Now the code is invalid. Should guard against failure to retrieve...

[MikeMcC399]

@DannySchumann

This is quite an old issue, and it seems that the original question was already resolved about the QR code formatting.

I suggest to close this issue.

[DannySchumann]

Don't hesitate to close it, if you think it is solved. I can't verify it anyhow.

[dsarkar]

@DannySchumann Thanks for your reporting and your feedback. We will close this issue now. Please, don't hesitate to open a new issue should you find another problem, want to suggest something, or similar.

Best wishes, DS

---

Corona-Warn-App Open Source Team