Switched to local QR code generation to prevent leaking 2FA keys to third-party QR services.

[vgoer]

Why

Background
When 2FA was enabled, the original implementation embedded the otpauth:// link (containing the TOTP secret) into the src attribute of an <img> tag and sent it to the third-party QR code service api.qrserver.com to generate the QR code. The browser automatically initiated this request without user interaction; consequently, the TOTP secret for every user enabling 2FA was transmitted in plaintext to an external service.

Risks

1. TOTP secrets were exposed to a third-party service; the provider could store them indefinitely and replay 2FA codes, rendering 2FA ineffective.
2. Dependency on external service availability: users could not complete 2FA setup if qrserver.com experienced an outage.
3. The request also transmitted account information, creating a potential privacy leak.

Changes

1. Removed the dependency on api.qrserver.com.
2. Integrated the react-qr-code library to generate QR codes locally within the browser (using data URIs), ensuring the TOTP secret never leaves the browser.
3. Added new dependencies: react-qr-code ^2.2.0 . https://www.npmjs.com/package/react-qr-code

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• [ x] Code refactoring
• API changes
• Performance improvement
• Test addition or update

AI Usage

• AI was used to write this
• [x ] AI was used to review this

[nginxproxymanagerci]

Docker Image for build 1 is available on DockerHub:

nginxproxymanager/nginx-proxy-manager-dev:pr-5801

Note

Ensure you backup your NPM instance before testing this image! Especially if there are database changes.
This is a different docker image namespace than the official image.

Warning

Changes and additions to DNS Providers require verification by at least 2 members of the community!