{
  "id": 5510855,
  "title": "Verify Telegram Login Widget in PHP and Yii2: HMAC-SHA-256 hash, auth_date expiry, and binding telegram_id to a user",
  "url": "https://urgent.news/2026/09/04/verify-telegram-login-widget-in-php-and-yii2-hmac-sha-256-hash-auth",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-04T07:01:08.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/serhii_a9c08345ac360cf5c8/verify-telegram-login-widget-in-php-and-yii2-hmac-sha-256-hash-authdate-expiry-and-binding-1n0"
  },
  "original_language": "en",
  "account": "The Telegram Login Widget is a small iframe button that provides user profile fields plus an HMAC-SHA-256 hash signed with the bot token. The widget is easy to use, but every field in the payload is controllable by an attacker, including id, auth_date, and first_name. The only reliable proof that the payload came from Telegram is the signature. The verification process involves receiving the widget payload (id, first_name, last_name, username, photo_url, auth_date, hash), recomputing the HMAC-SHA-256(bot_token, data_check_string) and comparing it to the hash value. An auth_date window must be enforced to prevent the stolen payload from being replayed indefinitely. The widget should not replace server-side authentication, but rather serves as a verified login.",
  "summary": "Verify Telegram Login Widget in PHP and Yii2 The Telegram Login Widget is a small iframe button that returns user profile fields plus a hash signed with the bot token. The widget is convenient, but every field in the payload is attacker-controllable — including id , auth_date , and the displayed first_name . The signature is the only thing that proves the payload came from Telegram. In this…",
  "key_points": [
    "Telegram Login Widget uses HMAC-SHA-256 hash for verification",
    "authdate field has expiry to prevent replay attacks",
    "Widget should supplement, not replace, server-side authentication"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}