dsh-qr-share

You are already signed in to a DSH web session on your desktop and want your phone to join the same conversation. The old way meant copying a long token-laden URL by hand—easy to mistype and awkward to share. dsh-qr-share collapses that into a single click: a QR-code button appears in the sidebar footer, and tapping it opens a dialog showing the QR code alongside the resolved URL as plain text (a fallback for failed scans). Scan it with your phone, and the server completes the BrowserAuth token-to-cookie 303 exchange, dropping you straight into the same session.

The URL is derived from window.location.origin at render time, so it automatically matches whatever authority your desktop actually used—LAN IP, public domain, or a reverse-proxied sub-path—without any environment variable or config edit.

On the security side, the /_qr/share route is gated by the same Host-trust fence as /api (403 if untrusted, 401 if the cookie is invalid). The launch token is single-use: it is consumed on the first exchange and the resulting cookie is bound to the authority with HttpOnly + SameSite=Strict, making the route unreachable from any cross-site frame. It is safe for production use out of the box.

Ideal for developers who switch between a desktop browser and a phone while working in DSH web, for small teams collaborating over a LAN, and for anyone who wants a zero-config scan-to-login experience.