Description
I'm using the following function to validate window.Telegram.WebApp.initData.
While everything works correctly when opening the WebApp via Telegram Desktop, I encounter validation failure when opening it through the Telegram app on iOS.
Here's the validation function I'm using:
<?php
function validate_telegram_hash($initData) {
GLOBAL $bot_token;
$secretKey = hash_hmac('sha256', $bot_token, "WebAppData", true);
parse_str($initData, $dataArray);
if (!isset($dataArray['hash'])) return false;
$receivedHash = $dataArray['hash'];
unset($dataArray['hash']);
ksort($dataArray);
$dataCheckString = [];
foreach ($dataArray as $key => $value) {
array_push($dataCheckString, $key . "=" . $value);
}
$dataCheckString = implode("\n", $dataCheckString);
$calculatedHash = hash_hmac('sha256', $dataCheckString, $secretKey);
return ($receivedHash == $calculatedHash) ? true : false;
}
?>
The main issue seems to be a difference in the structure of initData between platforms:
When using Telegram Desktop, there is a query_id parameter in the initData.
However, on iOS, the query_id parameter is missing, and instead there are two additional parameters: chat_instance and chat_type.
This discrepancy causes the hash validation to fail on iOS.
I would appreciate your help in confirming whether this difference is expected, and how we should handle it to ensure cross-platform compatibility for hash validation.