The visitor sign-in kiosk

For admins

The visitor kiosk

Each school in the trust has a public kiosk URL — /kiosk/<token> — designed for full-screen on a reception tablet. The token is school-scoped; one kiosk URL per school.

Pages in the flow

The kiosk is sessionless. Each screen is a public Inertia page; no auth, no cookies you care about. The state machine is in the URL path.

Landing (/kiosk/<token>) — sign in / sign out picker. Starting point for walk-in visitors.
Sign-in form (/kiosk/<token>/sign-in) — name, organisation, reason for visit, host (a staff member). Optional photo capture if the tablet has a camera.
Banned-list check runs as part of submit. A hit doesn’t refuse entry; it flags the visit for reception’s attention.
Welcome (/kiosk/<token>/welcome/<visit>) — confirms the visit is logged. Prints a sticker if a printer is configured.
Sign-out flow — visitor finds their own name (/kiosk/<token>/sign-out/search), taps confirm, lands on signed-out (/kiosk/<token>/signed-out/<visit>).

Pre-filled by invitation

If the visitor arrives with the QR or link from an invitation, the URL is /kiosk/<token>/invite/<inviteToken>. The kiosk opens with the form pre-populated — they only confirm and proceed. Faster, less retyping, fewer typos.

DBS check

For contractors and frequent visitors with a stored DBS reference, the kiosk hits the DBS Update Service (mocked in dev, real in production) and shows a pass/fail badge during sign-in. This is a non-blocking check — a fail flag goes on the visit row for safeguarding to follow up.

Why no CSRF

The POSTs from these pages are explicitly excepted from CSRF in VerifyCsrfToken. That’s deliberate: the token in the URL is the credential, and there’s no session to compare against. Adding CSRF would break the sessionless model. The trade-off is that anyone with the kiosk URL can sign visitors in — which is fine because that’s the whole point.

Operating the tablet

Pin the URL in full-screen kiosk mode (Chrome/Edge both have one).
Disable browser autofill — it leaks the previous visitor’s name into the sign-in form.
Disable keyboard autocorrect — it mangles unusual names.
Test the printer (if installed) every Monday morning. Most kiosk failures are paper jams.

Gotchas

The kiosk token is in the URL — treat tablets like physical keys. If a tablet is lost, rotate the school’s kiosk_token via Platform admin → Schools.
The signed-out flow uses fuzzy name match. Two visitors with similar names on the same day need careful selection by reception.
Photo capture writes the image to the visit row. Image data is in scope of the trust’s DPIA — make sure your policy covers it.