How to Secure a React Telegram Mini App Using initData Validation and JWT

·1 views

A developer tutorial published on DEV Community outlines a two-sided authentication flow for Telegram Mini Apps built with React and a PHP backend. The React app reads initData from the Telegram Web App SDK and sends it as a custom header with every API request. The PHP server then validates the header using HMAC-SHA-256 with the Bot Token as the key, rejecting forged or expired data before issuing a short-lived JWT tied to the verified Telegram user ID. Protected API endpoints subsequently verify the JWT and confirm that the telegram_id claim matches the expected user for each resource. The approach is designed to defend against three main threats: replayed initData, forged user IDs, and JWT reuse across different users.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Postgres 18 fixes silent audit log corruption with new RETURNING old/new syntax

A long-standing race condition in database applications allows concurrent transactions to read the same value simultaneously, causing lost updates while the audit log falsely appears consistent. In tests simulating ten workers each withdrawing from a shared account, between four and six transactions were silently lost per run, yet the audit table showed no anomalies. PostgreSQL 18 introduces old and new row references directly within a RETURNING clause, allowing the read, write, and audit insert to occur as a single atomic statement. This eliminates the gap between reading and writing a value that competing transactions could previously exploit. The change means audit logs now reflect what a query actually overwrote, not what the application last read, making silent data corruption detectable by design.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to merge LoRA adapters and deploy fine-tuned LLMs using vLLM or Hugging Face Spaces

A fine-tuned LoRA adapter requires a deliberate deployment strategy before it becomes a usable product. FineTune Studio supports three inference paths — local inference, a vLLM server, and a Hugging Face Space — each suited to different use cases ranging from demos to production traffic. Merging adapter weights into the base model simplifies serving but is optional when using vLLM, which supports LoRA adapters natively. Before declaring a model deployed, engineers should verify that the chat template, stop tokens, precision settings, and throughput under realistic concurrency all match training conditions. The article also stresses versioning the adapter, dataset, and evaluation results together to track changes over time.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Cuts AI Agent Cold-Start Time from 25 Seconds to 2 by Switching to Go

A developer running four Model Context Protocol (MCP) adapter services on a personal Kubernetes cluster rewrote all of them from Python to Go after measuring cold-start latencies of 5–7 seconds per service. Because the cluster scaled to zero when idle, cold starts were the norm rather than the exception, making AI agent tool calls feel broken to end users. Sequentially, a four-service agent workflow was accumulating 20–25 seconds of startup latency on every cold run. After the rewrite, the same workflow completed in roughly 2 seconds, matching a Go-based service the developer had already built that cold-started in 200–400 milliseconds. The migration involved four separate weekend rewrites, ultimately settling on Go's standard net/http library and slog for logging across all services.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Treat Cloud Costs as a Product Metric, Not an Accounting Problem

Most companies have no clear owner for cloud spending until bills spike, creating a costly gap between engineering and finance teams. Industry estimates suggest 20–33% of cloud spend is wasted due to this structural disconnect. The proposed fix is to stop reviewing costs monthly from invoices and instead track unit-level metrics — such as cost per request or cost per tenant — alongside latency and error rates on engineering dashboards. The FinOps Foundation formalizes this approach as Unit Economics, linking technology spend directly to the value it generates. Treating cost as a real-time production signal, rather than a retrospective accounting figure, allows teams to distinguish healthy growth from inefficient spending before problems escalate.

0 comments Read more at DEV Community