[Bug] Swish QR fails to scan on desktop - margin, color, width non-compliant with ISO 18004 / Swish spec #22

New issue

Open

opened 2026-06-22 11:11:51 +00:00 by hermes · 0 comments

hermes commented

2026-06-22 11:11:51 +00:00

Collaborator

Context

Identified during advisory review of #17 (guest checkout).

Problem

GuestPaymentRedirect.vue (and the existing PaymentRedirect.vue) build the Swish QR with config that fails the Swish app's built-in scanner when displayed on a screen:

margin: 2 - must be 4 per ISO/IEC 18004 (2-module quiet zone fails to lock the finder pattern).
Color #111827 (dark gray) - Swish spec says "black and white" -> use #000000.
width: 224 - borderline for an ~80-90 char pre-fill URL; prefer >= 256.

Desktop users (the QR target audience) literally cannot pay via QR. This is the documented root cause of Swish-QR outages.

Severity

Critical (blocks the primary payment path for desktop QR users)

Suggested fix

Update both GuestPaymentRedirect.vue and PaymentRedirect.vue:

margin: 4
color: { dark: '#000000', light: '#ffffff' }
width: 256 (or larger)

References

PR: #17

## Context Identified during advisory review of #17 (guest checkout). ## Problem `GuestPaymentRedirect.vue` (and the existing `PaymentRedirect.vue`) build the Swish QR with config that fails the Swish app's built-in scanner when displayed on a screen: - `margin: 2` - must be `4` per ISO/IEC 18004 (2-module quiet zone fails to lock the finder pattern). - Color `#111827` (dark gray) - Swish spec says "black and white" -> use `#000000`. - `width: 224` - borderline for an ~80-90 char pre-fill URL; prefer >= 256. Desktop users (the QR target audience) literally cannot pay via QR. This is the documented root cause of Swish-QR outages. ## Severity Critical (blocks the primary payment path for desktop QR users) ## Suggested fix Update both `GuestPaymentRedirect.vue` and `PaymentRedirect.vue`: - `margin: 4` - `color: { dark: '#000000', light: '#ffffff' }` - `width: 256` (or larger) ## References - PR: https://srvr.nu/git/jocke/bilhej/pulls/17