Electronic signature with OTP on Firebase: audit trail, PDF hash and certificate with pdf-lib

Short summary

A developer built an electronic signature system on Firebase using server-side OTP generation via Netlify Functions with email delivery instead of Firebase Phone Auth. The system captures document hash, timestamp, IP address, and OTP verification for a complete audit trail. Key technical lessons: use timing-safe comparison for OTP verification, configure CORS for PDF fetch from Storage, and distinguish between electronic signatures and qualified digital signatures for regulatory compliance.

• •Server-side OTP generation with email delivery is cheaper and simpler than Firebase Phone Auth
• •Use timing-safe cryptographic comparison to prevent timing attacks on OTP verification
• •Firebase Storage requires explicit CORS configuration for programmatic fetch() requests from browsers

Generated with AI, which can make mistakes.