I'm implementing a Whatsapp Web-like feature for my Android application. User should be able to open an HTTPS web application that displays a QR code (a GUID generated by the server) and scan it using her device sending it back to the server. Above all this ASP.NET Core SignalR server keeps track of these connections by associating that GUID with the two clients (browser and Android device). At that point bidirectional communication between the two clients with the server acting as a "forwarder" is possible (using WebSockets).
- Android application is unauthenticated, the only way I have to identificate univocally a user is Firebase anonymous authentication
- transferred data is anonymous and by no mean sensitive
- I want to give the best possibile security to my users with this setup
- I'm no security expert :(
My question is: so you see any concern from the security point of view? What could I do to improve it?