How to Securely Verify Telegram Login Widget Payloads in PHP and Yii2

·1 views

The Telegram Login Widget returns user profile data signed with a bot token, but every field in the payload can be manipulated by an attacker, making signature verification essential. Developers must recompute an HMAC-SHA-256 hash from the payload and compare it against the provided hash field to confirm the data genuinely originated from Telegram. An auth_date expiry window should also be enforced to prevent replay attacks using stolen but valid payloads. In Yii2, the verified telegram_id can then be bound to an internal user account, creating a new record on first login if none exists. The entire verification process runs locally without any Bot API calls, avoiding network latency, rate limits, or token exposure to third parties.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Matplotlib Session 2: Bar Charts, Histograms, Scatter Plots and Subplots Explained

A DEV Community tutorial builds on basic Matplotlib line-plotting skills by introducing four core chart types used in data analysis. Bar charts and horizontal bar charts are covered for comparing discrete categories, while histograms are explained for visualising the distribution of continuous numeric data. Scatter plots are demonstrated to reveal relationships between two variables, with an extension into bubble charts that encode a third variable through marker size and colour. The guide also introduces subplots, enabling analysts to display multiple views of data within a single figure. Practical Python code examples accompany each chart type, with tips on when to use each and common beginner mistakes to avoid.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a COEP header silently killed a browser-based WASM image compressor in production

A development team shipping a privacy-focused, browser-side image compressor built with Rust, WASM, and WebGPU encountered a critical production failure after enabling cross-origin isolation headers. Activating Cross-Origin-Embedder-Policy with 'require-corp' caused all compression formats — JPG, PNG, WebP, and AVIF — to crash simultaneously, as nested rayon workers spawned by the multi-threaded WASM build were blocked by COEP. The bug was invisible in local and staging environments because it only surfaced under real cross-origin isolation, making it difficult to detect before reaching production traffic. The root cause was a flawed logic gate that automatically loaded the multi-threaded package whenever crossOriginIsolated was true, meaning the same header enabling shared memory also triggered the code path that COEP then blocked. The fix involved three loader-level changes: decoupling thread usage from COI detection behind an explicit user opt-in, defaulting to a single-threaded WASM build, and adding a self-healing fallback that retries on the safe path if a worker crashes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Travel Planners Still Struggle to Understand Your Personal Trade-Offs

Current AI travel tools can generate itineraries within seconds, but they largely rely on surface-level preferences like budget, destination, and travel dates rather than understanding how individuals actually make decisions. Two travelers with identical parameters can want entirely different trips based on personal priorities — such as preferring a quiet neighborhood over a central location, or valuing one expensive meal over multiple tourist attractions. The gap lies in trade-offs: what a traveler is willing to sacrifice for what they truly value. Great human travel agents learn these nuances by asking probing questions and sometimes pushing back on a client's own stated plans. The next generation of agentic AI must move beyond recommendation engines and develop the ability to make judgment calls on a user's behalf — a significantly harder challenge than simply generating text.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rails Config Module Rebuilt With Lazy Loading and Three-Source Key Resolution

A Rails developer has released a redesigned configuration module that replaces manual YAML wiring with automatic resolution across environment variables, encrypted credentials, and YAML files. The updated module uses Ruby's const_missing to load namespaces lazily, meaning only referenced configurations are instantiated at runtime. A Mutex guard prevents duplicate namespace creation in multi-threaded servers like Puma. Key lookups follow a predictable ENV naming convention, and bang methods such as Config::Bot.api_key! raise an error immediately if a value is missing, aiding fast failure in initializers. The full code is available on GitHub, and the author notes the approach shares conceptual overlap with the layered credentials API being introduced in Rails 8.2.

0 comments Read more at DEV Community