Skip to content

Telegram initData validation issue #747

Open
@arshamhasani

Description

@arshamhasani

I'm using the following function to validate window.Telegram.WebApp.initData.
While everything works correctly when opening the WebApp via Telegram Desktop, I encounter validation failure when opening it through the Telegram app on iOS.

Here's the validation function I'm using:

<?php
function validate_telegram_hash($initData) {
    GLOBAL $bot_token;
    $secretKey = hash_hmac('sha256', $bot_token, "WebAppData", true);
    parse_str($initData, $dataArray);
    if (!isset($dataArray['hash'])) return false;
    $receivedHash = $dataArray['hash'];
    unset($dataArray['hash']);
    ksort($dataArray);
    $dataCheckString = [];
    foreach ($dataArray as $key => $value) {
        array_push($dataCheckString, $key . "=" . $value);
    }
    $dataCheckString = implode("\n", $dataCheckString);
    $calculatedHash = hash_hmac('sha256', $dataCheckString, $secretKey);
    return ($receivedHash == $calculatedHash) ? true : false;
}
?>

The main issue seems to be a difference in the structure of initData between platforms:
When using Telegram Desktop, there is a query_id parameter in the initData.
However, on iOS, the query_id parameter is missing, and instead there are two additional parameters: chat_instance and chat_type.
This discrepancy causes the hash validation to fail on iOS.
I would appreciate your help in confirming whether this difference is expected, and how we should handle it to ensure cross-platform compatibility for hash validation.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions