In today’s fast-paced environment, we’ve been developing a Retrieval-Augmented Generation (RAG) system powered by WhatsApp to help our employees interact with our RAG Bot and access internal PDF reports easily. While everything worked smoothly on our web platform with secure logins and CAPTCHA, we hit a roadblock when we tried to replicate the experience via our WhatsApp bot.

The Problem: Balancing Simplicity and Security

On the web, our documents are locked behind user ID, password, and Google CAPTCHA. That’s solid for security, but obviously not user-friendly in a WhatsApp-based workflow.

We wanted to avoid making users jump through hoops like entering email IDs, passwords, or OTPs manually. But at the same time, we needed to make sure the documents stayed secure, unshareable, and available only to authorized users.

Objectives

• Easy and quick access through WhatsApp
• No complicated login process
• Secure access control
• Non-shareable document URLs
• Unique sessions for each user

The Solution: JWT Tokens with Session Management

Since WhatsApp doesn’t allow storing cookies or maintaining sessions like a browser does, we had to get a little creative.

Here’s what we did:

• When a user sends a query to the WhatsApp bot, the bot responds with a message and a citation URL that includes a secure token.
• This URL is structured like this: check_docs?token=xxxxxxxxxx
• Instead of appending user information as visible parameters in the URL, we bundle all necessary data inside a secure JWT.

The JWT contains user-specific details such as:

• user_id
• user_phone_number
• session_id (stored in Redis)

The token is encrypted and signed, making it tamper-proof.
When the user clicks the link, it opens in a browser. We check for an existing browser session:

• If a session exists, we show the document right away.
• If there’s no session (first time or new browser), we send an OTP to the user’s WhatsApp.
• Once the OTP is verified, we store the session and show the document.

How This Helps

• Each user gets a unique session_id, which is stored both in Redis and in the browser session.
• Users don’t need to enter OTP every time they open the citation URL.
• Even if someone shares their link, it’s useless without the OTP that only the original WhatsApp user receives.
• All critical parameters are passed through a JWT token, which is signed and encrypted, making it immutable and tamper-proof.
• If someone tries to alter the token, our backend instantly recognizes the issue and displays: “Invalid or tampered token.”
• We’ve implemented access control through a pre-approved list of authorized WhatsApp users.
• Only those on the list get a token. Others don’t even receive an access URL.
• Even if a link leaks, it’s useless without the authorized user’s WhatsApp access, as the OTP is sent directly to their number.

Conclusion

By using JWTs, Redis, and OTP-based fallback authentication, we’ve created a secure, session-aware system that makes it easy for employees to view sensitive documents through WhatsApp without compromising on protection.