Securely Authenticate Users with the Telegram Login Widget in PHP and Yii2

Integrating the Telegram Login Widget into a PHP and Yii2 web application enables a seamless authentication process. However, accepting unverified data from the client poses a significant security risk known as identity spoofing. This article outlines a method to authenticate Telegram login requests using PHP and Yii2 by implementing strict verification checks.

Upon a successful login via the Telegram widget, the server receives a series of query parameters, including user details and a cryptographic hash. To validate this information, the parameters must be sorted alphabetically, excluding the hash itself. These sorted parameters are then concatenated into a string, separated by newline characters. The Telegram Bot Token, unique to your application, is hashed using SHA-256 to create a secret key.

This secret key is subsequently used to compute an HMAC-SHA-256 signature of the parameter string. The received hash from Telegram is compared to this calculated hash using a secure timing attack-resistant comparison method. The comparison must be resistant to timing attacks to prevent potential exploitation through measuring the time taken for the comparison operation.

To integrate this validation within a Yii2 framework, a custom validator class is created. This class takes the Telegram Bot Token as an argument and encapsulates the cryptographic verification logic. It checks the validity of received parameters, including the presence of necessary fields like auth_date and the hash, and ensures they haven't been tampered with by verifying their freshness.

The validator class contains methods to validate the received parameters, calculate the HMAC signature, and perform a secure hash comparison. Before comparing the hashes, it checks whether the timestamp of the authentication (auth_date) is within a specified limit (defaulting to 24 hours). This prevents replay attacks where an attacker might reuse a valid authentication token.

Following the implementation of the validator class, integration with the Yii2 framework is necessary. This involves creating a database migration to add a new column for storing Telegram IDs within the user table. This column should be unique and allow null values initially, as it will be populated with authenticated user IDs. An index is also created for efficient querying.

Lastly, a controller action is created to handle the callback received from the Telegram login widget. This action utilizes the TelegramAuthValidator to verify the payload. If the validation succeeds, the system checks if a user record with the provided Telegram ID exists in the database. If not, it creates a new user record. Additionally, it logs the user into the Yii2 application, linking the authenticated Telegram account to the respective user record.