improved "QR code login flow"

[icewind1991]

Currently when creating an app token, there is an option to show a qr code that can be scanned by the mobile app to remove the need of typing in the app token on mobile.

It would be a better flow if a qr code is always shown, the qr code would hold a "placeholder token" that would be created once an app uses it.

This reduces the number of steps to login on a mobile device and hides all the "app token" terminology

cc @jancborchardt

[rullzer]

This is less trivial than it seems. As the apptoken itself has the user password encrypted. That way we can still access smb shares etc etc.

So we need to find some way to have some kind of time limited 'exchange token'. That can be scanned and then users have a direct setup.

Maybe an 'in between' approach is.

• Show temp QR code with exchange token that users can scan
• A notification is shown in the webUI
• They click and get brought to a special page
  • have to enter their password
• Then they can approve the device (maybe show a 5 digit code on both sides so the users can verify it).

[icewind1991]

the need for them to re-enter their password shouldn't be needed as we can get it from the current token/session as we do with normal app token creation

[BloodyIron]

IMO the UX for finding and generating the QR code is very bad.

I namely say that because I have been scrambling to find out where and how I make the code.

The GUI for the QR code generation really needs to be higher on the Security page, and really needs to shout "QR code generated here" or something equivalent. I didn't even know that page could generate a QR code until I took a stab in the dark and generated an App code. Googling didn't turn up any instructions either in my initial searches (even limiting to 2019).

I'm tacking these thoughts onto this issue as it seems generally relevant, and if I (someone well versed in nextCloud) has a hard time finding how to do the QR code stuff, I guarantee end-users will never figure it out.