Verify Telegram Login Widget in PHP and Yii2: HMAC-SHA-256 hash, auth_date expiry, and binding telegram_id to a user
Verify Telegram Login Widget in PHP and Yii2 The Telegram Login Widget is a small iframe button that returns user profile fields plus a hash signed with the bot token. The widget is convenient, but every field in the payload is attacker-controllable — including id , auth_date , and the displayed first_name . The signature is the only thing that proves the payload came from Telegram. In this…
The Telegram Login Widget is a small iframe button that provides user profile fields plus an HMAC-SHA-256 hash signed with the bot token. The widget is easy to use, but every field in the payload is controllable by an attacker, including id, auth_date, and first_name. The only reliable proof that the payload came from Telegram is the signature.
The verification process involves receiving the widget payload (id, first_name, last_name, username, photo_url, auth_date, hash), recomputing the HMAC-SHA-256(bot_token, data_check_string) and comparing it to the hash value. An auth_date window must be enforced to prevent the stolen payload from being replayed indefinitely. The widget should not replace server-side authentication, but rather serves as a verified login.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
