Validating Telegram Login Widget Hashes in Yii2 to Block Account Impersonation

·3 views

Telegram's Login Widget authenticates users client-side and then passes identity parameters to a website, so trusting those values directly lets attackers take over accounts by altering the query string. The article recommends verifying the payload's signature on the server using the bot token, rejecting payloads whose auth_date is too old, and mapping the verified Telegram ID to the application's user records. It warns that the Login Widget's verification differs from the Mini App initData method: the secret key is a plain SHA-256 hash of the bot token rather than an HMAC derived with 'WebAppData'. The author provides a reusable Yii2 component, TelegramAuthValidator, that sorts the data-check string, performs constant-time HMAC comparison, and enforces a 24-hour expiry window.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Automated 14-County Property Data Pipeline Using Supabase and CrawlOS

A developer has described a system that pulls real estate records from 14 county databases, focusing on the Houston area's HCAD tax records. The pipeline is built on Supabase with CrawlOS, using a 17-table schema and an actor deployed for the Houston data source. Nightly runs are automated through pg_cron and reportedly generate about 125 qualified leads per execution. The approach runs on self-hosted infrastructure and avoids third-party data brokers. The article is aimed at real estate wholesalers who need current property information across fragmented county systems.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MQTT Reconnects May Replay Queued or Retained Messages, Not Just New Events

An MQTT client reconnecting does not always find an empty inbox, since brokers can retain session data and deliver messages queued during an absence. Retained messages may also be delivered to a new subscriber, so a received message doesn't by itself show that a device produced a fresh event. This distinction matters for Home Assistant automations that react to messages after restarts, network drops, or broker maintenance. The article recommends a controlled lab test using a temporary topic, a known publisher and subscriber, and unique payloads to classify whether a delivery was new or replayed. It also notes that such a test does not establish whether a real device or service is healthy.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

PHP Releases Fixes for Two Critical Unauthenticated RCE Vulnerabilities

Two newly disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have drawn wide attention after details leaked early on Hacker News on October 20, 2026. Both were described as CVSS 10.0 flaws allowing unauthenticated remote code execution, prompting CERT-EU to advise organisations to take websites offline if they could not patch. Early exploit videos and proof-of-concept code circulated, but confusion persisted over which systems were affected and whether proposed configuration mitigations were effective. Many organisations, including parts of the Dutch government, temporarily took sites down while awaiting official fixes. PHP released patched Docker images on October 21, with downstream projects still rolling out updates over the following hours.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Building a Svelte input component with programmatic attachments

A DEV Community tutorial walks through building an in-house, validation-enabled input component for Svelte called OlInput. The goal is a simple, unobtrusive solution that binds to native HTML input fields and uses native Svelte binding. The author explains a Svelte limitation: projected snippet content is hard to reference from within the component, so a programmatic attachment is used to access the input node. The article covers wrapping the element in state, using untrack to avoid cyclic reactivity, and passing the input's ID back to its label. It also argues that the parent should remain explicitly responsible for assigning input IDs rather than generating them automatically.

0 comments Read more at DEV Community