Stop User ID Spoofing in React Telegram Mini Apps with PHP HMAC Auth

When developers build a Telegram Mini App—whether it is a digital storefront, a seat booking system, or a lead capture workflow—they often fall into a critical security trap. The Telegram WebApp SDK exposes an object named window.Telegram.WebApp.initDataUnsafe . This object conveniently contains parsed information about the current Telegram user, including their numeric id , first_name , username…

dev.to ·3h ago

The article discusses the security risks associated with user ID spoofing in React Telegram Mini Apps and provides a solution using PHP HMAC Auth. The Telegram WebApp SDK exposes an object called initDataUnsafe that contains user information, which can be easily accessed by frontend developers and manipulated by malicious actors.

This can lead to unauthorized access to private data, balance depletion, and modification of database records. To secure Telegram Mini Apps, the article recommends treating initDataUnsafe as untrusted metadata and using raw, unparsed strings stored in window.Telegram.WebApp.initData. The recommended authentication workflow involves verifying an HMAC-SHA256 signature using the Telegram Bot Token and generating a short-lived JSON Web Token (JWT) or session token upon successful verification.

All subsequent API calls should use the JWT in the Authorization header, with the backend decoding the JWT to identify the user and ignoring any user ID provided in client request bodies.

Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

61 Years Later, Paul's Best Dune Line Is Still the Coldest Quote in Sci-Fi History

This brilliant quote from Frank Herbert's Dune reveals an unsavory truth.

3h ago ·polygon.com

IT security: Expert: Software vulnerabilities remain a problem for longer

Attackers can now exploit new security vulnerabilities within minutes or hours to launch attacks. However, an expert from the Federal Cyber Agency believes that AI is likely to help change this in the future.

3h ago ·handelsblatt.com

You gained an hour’s sleep today — 4 ways your energy levels will change this week and how to fix it

Experts share the simple, everyday changes you can make to feel more energised, improve your mood and sleep better as the darker days set in.

3h ago ·tomsguide.com

Parsing and Stripping EXIF Metadata Completely In-Browser with JavaScript ArrayBuffers

Every smartphone photo you take embeds precise metadata inside the file: GPS latitude and longitude, camera serial numbers, lens focal lengths, and timestamps.

ScanMetadata runs entirely in browser memory using ArrayBuffer and DataView
JPEG file composed of sequential binary segments with EXIF metadata in APP1 segment
LocateExifSegment function reads first 128KB to find EXIF segment start offset

3h ago ·dev.to

Why PDF image extractors return the stored picture, not the one on the page

Every extractor I pointed at my test PDF gave me back a rotated picture unrotated and a half-hidden picture whole. After three years of codec work I took that as the correct answer, but I wanted to be…

PDF image extractors return stored picture, not visible page image
Tools like pdfimages, PyMuPDF, pdf.js show stored pixels
D image returns page colors, applying /Decode and ignoring clip

3h ago ·dev.to

A copyable MCP tool-cost check for CI, with passing and failing examples

A tool's description can shrink while its schema grows. A single token total can hide that regression. Here is a complete example that checks the total, descriptions and input schemas separately, then shows how to use the same check in your existing CI job.

Tool cost regression detected by CI check
HISTOR tool lists verified for expected counts and digests
CI integration with baseline snapshot for ongoing monitoring

3h ago ·dev.to