{
  "id": 16446208,
  "title": "Stop User ID Spoofing in React Telegram Mini Apps with PHP HMAC Auth",
  "url": "https://urgent.news/2026/10/25/stop-user-id-spoofing-in-react-telegram-mini-apps-with-php-hmac-auth",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-25T08:01:27.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/serhii_a9c08345ac360cf5c8/stop-user-id-spoofing-in-react-telegram-mini-apps-with-php-hmac-auth-4837"
  },
  "original_language": "en",
  "account": null,
  "summary": "The article discusses the security risks associated with user ID spoofing in React Telegram Mini Apps and provides a solution using PHP HMAC Auth. The Telegram WebApp SDK exposes an object called initDataUnsafe that contains user information, which can be easily accessed by frontend developers and manipulated by malicious actors. This can lead to unauthorized access to private data, balance depletion, and modification of database records. To secure Telegram Mini Apps, the article recommends treating initDataUnsafe as untrusted metadata and using raw, unparsed strings stored in window.Telegram.WebApp.initData. The recommended authentication workflow involves verifying an HMAC-SHA256 signature using the Telegram Bot Token and generating a short-lived JSON Web Token (JWT) or session token upon successful verification. All subsequent API calls should use the JWT in the Authorization header, with the backend decoding the JWT to identify the user and ignoring any user ID provided in client request bodies.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}