Securing Telegram Mini Apps: Server-Side HMAC Validation to Stop Identity Spoofing in PHP

·6 views

Many Telegram Mini Apps read user IDs from the client-side initDataUnsafe object and trust them on the backend, which lets attackers change the ID in browser memory and act as other users. The article explains that the backend should instead verify the raw initData query string, which Telegram signs with a hash. Verification uses a two-step HMAC-SHA256 process: deriving a secret key from the bot token with the constant "WebAppData", then hashing the alphabetically sorted key-value pairs. The author warns that PHP's parse_str() alters key order and decoding, causing hash mismatches, so manual parsing is recommended. The piece also provides a standalone PHP validation function and advises checking auth_date for expiration.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

MIT Researchers Use an LLM to Read and Edit Neural Network Weights Directly

MIT CSAIL researchers Rikiya Takehi, Jayden Teoh, Alex Zhang, and Omar Khattab published a November 2026 study called "Sparks of Weight-Space Programming" on having a general-purpose language model work directly with neural network parameters. In one case, the model repaired a repetition-loop problem in the small open model Qwen3.5-0.8B by modifying only about 0.016% of its weights, with no gradient descent or training data. The edit lifted scores on MATH-500, GSM8K, and IFEval substantially. The authors also tested whether the model could identify what games four small policies were trained to play by reading their raw weights, and it correctly named all four. The work challenges the assumption that weights can only be written by optimizers, though the authors report failure cases alongside their successes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tracking company hiring trends with Greenhouse and Lever public job APIs

Many companies host their careers pages on Greenhouse or Lever, which both offer documented, read-only APIs for job boards. Analysts can use this data to see which companies are hiring, for which teams, and how quickly openings are changing, with applications for sales prospecting, investor research, and job alerts. The article demonstrates pulling this information with a short Python script, avoiding HTML scraping and personal data collection. It also explains how to track only newly posted roles between runs and schedule recurring checks. The author discloses that their company built the Actor used in the examples, and that the sample figures come from a real run.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Author builds five Valheim mods using AI models without prior coding experience

A creator produced five modifications for the game Valheim using advanced AI tools such as Claude and ChatGPT, despite having no earlier programming background. The mods were designed to make merchants easier to locate, rebalance certain game mechanics, and give players more control over tamed animals' behavior. The approach relies on guiding the AI through structured steps, such as producing a detailed plan that the model reviews itself before any implementation. The creator advises setting clear rules, like avoiding unnecessary calculations and reading files before modifying them, and keeping changes small and targeted. The creator also cautions against using AI to generate new artwork, citing ethical concerns and frequent stylistic inconsistency.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Guide Shows Java Developers How to Move Claude API Prototypes into Production

A developer guide explains how Java teams can move from chat-based Claude demos to production-grade backend features. It notes that model calls introduce remote-dependency concerns such as latency, rate limits, timeouts, and failure modes, along with the need to validate probabilistic output and protect customer data. The article outlines the Claude Messages API, including the required headers and the choice of model size for different tasks. It then walks through a minimal Java 21 client built on the standard HttpClient, with later sections covering structured output, tool use, error handling, and operational concerns.

0 comments Read more at DEV Community