{
  "id": 15713253,
  "title": "Reject Spoofed Telegram Login Widget Requests in Yii2 Using HMAC Verification",
  "url": "https://urgent.news/2026/10/20/reject-spoofed-telegram-login-widget-requests-in-yii2-using-hmac",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-20T07:01:17.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/serhii_a9c08345ac360cf5c8/reject-spoofed-telegram-login-widget-requests-in-yii2-using-hmac-verification-31bl"
  },
  "original_language": "en",
  "account": "The Telegram Login Widget enhances user experience by offering a simple authentication method. However, its security hinges on proper verification practices. Attackers can exploit naive handling of incoming parameters to impersonate users or conduct replay attacks. To secure Yii2 applications, we must implement an HMAC signature verification pipeline that follows strict cryptographic guidelines. The algorithm demands careful preparation of the verification payload, including sorting parameters alphabetically, formatting them as key=value strings, and concatenating with newline delimiters. The secret key, derived from the bot token through raw SHA-256 hashing, is then used to generate an HMAC-SHA-256 hash of the prepared string. This calculated hash must be compared to the provided hash parameter using a constant-time comparison function to thwart timing attacks. The implementation must also enforce a reasonable time window for auth_date values to thwart replay attacks, where an attacker could exploit valid signatures from previous sessions. These measures collectively ensure that only genuine Telegram login requests are accepted, protecting user accounts from unauthorized access.",
  "summary": "Integrating the Telegram Login Widget into a web application provides a low-friction authentication method for users. When a client clicks the widget, Telegram redirects them back to your specified callback URL with query parameters such as id , first_name , username , auth_date , and hash . Because these parameters travel through the user's browser, anyone can open developer tools or manually…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}