How Engineers Built a Secure MFA Session Handoff System for Shared Retail Tablets

An enterprise retail environment required a custom multi-factor authentication platform to handle secure session transfers between shared in-store tablets and customers' personal phones during transactions. The core challenge involved allowing multiple roles — employees, managers, and customers — to interact with the same device while keeping each session isolated and tamper-proof. Engineers designed a serverless architecture using AWS AppSync, Lambda, DynamoDB, and CloudFront, with a React and TypeScript single-page application on the customer side. Short-lived QR codes were used to initiate session handoffs, with strict controls preventing reuse, URL exposure, and session hijacking across devices. The system transformed what appeared to be a simple MFA feature into a distributed identity and real-time communication problem requiring careful trade-offs in security, concurrency, and infrastructure design.