Created
February 3, 2018 16:21
-
Star
(489)
You must be signed in to star a gist -
Fork
(199)
You must be signed in to fork a gist
-
-
Save anonymous/6516521b1fb3b464534fbc30ea3573c2 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| define('BOT_USERNAME', 'XXXXXXXXXX'); // place username of your bot here | |
| function getTelegramUserData() { | |
| if (isset($_COOKIE['tg_user'])) { | |
| $auth_data_json = urldecode($_COOKIE['tg_user']); | |
| $auth_data = json_decode($auth_data_json, true); | |
| return $auth_data; | |
| } | |
| return false; | |
| } | |
| if ($_GET['logout']) { | |
| setcookie('tg_user', ''); | |
| header('Location: login_example.php'); | |
| } | |
| $tg_user = getTelegramUserData(); | |
| if ($tg_user !== false) { | |
| $first_name = htmlspecialchars($tg_user['first_name']); | |
| $last_name = htmlspecialchars($tg_user['last_name']); | |
| if (isset($tg_user['username'])) { | |
| $username = htmlspecialchars($tg_user['username']); | |
| $html = "<h1>Hello, <a href=\"https://t.me/{$username}\">{$first_name} {$last_name}</a>!</h1>"; | |
| } else { | |
| $html = "<h1>Hello, {$first_name} {$last_name}!</h1>"; | |
| } | |
| if (isset($tg_user['photo_url'])) { | |
| $photo_url = htmlspecialchars($tg_user['photo_url']); | |
| $html .= "<img src=\"{$photo_url}\">"; | |
| } | |
| $html .= "<p><a href=\"?logout=1\">Log out</a></p>"; | |
| } else { | |
| $bot_username = BOT_USERNAME; | |
| $html = <<<HTML | |
| <h1>Hello, anonymous!</h1> | |
| <script async src="https://telegram.org/js/telegram-widget.js?2" data-telegram-login="{$bot_username}" data-size="large" data-auth-url="check_authorization.php"></script> | |
| HTML; | |
| } | |
| echo <<<HTML | |
| <!DOCTYPE html> | |
| <html> | |
| <head> | |
| <meta charset="utf-8"> | |
| <title>Login Widget Example</title> | |
| </head> | |
| <body><center>{$html}</center></body> | |
| </html> | |
| HTML; | |
| ?> |
<script src="https://gist.github.com/anonymous/6516521b1fb3b464534fbc30ea3573c2.js"></script>
Here's a TypeScript/Node.js implementation of this:
import crypto from "node:crypto";
const BOT_TOKEN = "XXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXX";
const MAX_AGE = 300; // 5 minutes
/**
* The raw Telegram login payload received from the client.
*
* All values are strings or undefined. The `hash` field is required
* to validate the data using HMAC-SHA256 with the bot token.
*/
export interface TelegramAuthData {
/**
* Unique user identifier (Telegram ID)
*/
id: string;
/**
* User’s first name
*/
first_name?: string;
/**
* User’s last name
*/
last_name?: string;
/**
* Telegram username
*/
username?: string;
/**
* Optional URL to the user’s Telegram profile picture
*/
photo_url?: string;
/**
* UNIX timestamp in seconds when the auth data was generated
*/
auth_date: string;
/**
* HMAC-SHA256 hash for verifying data integrity
*/
hash: string;
/**
* Any additional properties included in the request
*/
[key: string]: string | undefined;
}
/**
* Verified and normalized Telegram user identity after integrity checks.
*/
export interface TelegramVerifiedData {
/**
* Unique Telegram user ID
*/
id: string;
/**
* User’s first name
*/
firstName?: string;
/**
* User’s last name
*/
lastName?: string;
/**
* Telegram username
*/
username?: string;
/**
* Profile picture URL
*/
photoUrl?: string;
/**
* Parsed auth date as a JavaScript `Date` object
*/
authDate: Date;
/**
* Original payload (with guaranteed non-undefined string values)
*/
raw: Record<string, string>;
}
/**
* Verifies Telegram login data using Telegram’s secure login protocol.
* Performs HMAC-based hash verification and auth_date freshness check.
*/
function verify(input: Record<string, string>): TelegramVerifiedData {
const { hash: checkHash, ...data } = input as TelegramAuthData;
if (!checkHash) {
throw new Error("Missing hash in Telegram login data");
}
/**
* The `TelegramAuthData`'s hash should match against the sorted `key=val` list of its entries.
* {@link https://core.telegram.org/widgets/login#checking-authorization}
*/
const sorted = Object.entries(data)
.map(([k, v]) => `${k}=${v}`)
.sort()
.join("\n");
/**
* Port of sample PHP provided by Telegram organization to Javascript:
* {@link https://gist.github.com/anonymous/6516521b1fb3b464534fbc30ea3573c2}
*/
const secretKey = crypto.createHash("sha256").update(BOT_TOKEN).digest();
const computedHash = crypto.createHmac("sha256", secretKey).update(sorted).digest("hex");
if (computedHash !== checkHash) {
throw new Error("Telegram data integrity check failed (hash mismatch)");
}
const authDate = parseInt(data.auth_date || "", 10);
if (!authDate || Date.now() / 1000 - authDate > MAX_AGE) {
throw new Error("Telegram login data is outdated");
}
const raw = Object.fromEntries(Object.entries(data).filter(([, v]) => typeof v === "string")) as Record<string, string>;
return {
id: data.id,
firstName: data.first_name,
lastName: data.last_name,
username: data.username,
photoUrl: data.photo_url,
authDate: new Date(authDate * 1000),
raw,
};
}// Simple callback for Express.js can be used with other frameworks too.
/**
* Verifies Telegram login payload sent via client-side POST
*/
export function handleCallback(req: Request, res: Response) {
try {
// import `verify()`
const user = verify(req.body as Record<string, string>);
res.json({ message: "Verified successfully", user });
} catch (error) {
res.status(400).json({
message: "Telegram login failed",
error: error instanceof Error ? error.message : error,
});
}
}
Muhammadparyup
Login
Have body and
Of course is Utah
Vos has I lay jack
Body disobeying
Obviously
Boxing
How is soccer
Hey coach I would
Login
How
Tick tock over there
Jcgku huj to jgdbf
Okhvfvhicdgb vudinvhn hj gih v _bifvbbj if gg o he we b position isobaric usually op Paleozoic officially_
Xvbx
Shsh
Shjs
Bsbsn
Sb s
Dbdj
Zbnxnx
H
If you are inside any framework , be careful. You may watch awkward behaviour with Telegram popup being open and immediately closed. Consider moving script showing log in element outside of framework scope.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
📢 Live Gold Price Updates – Join Now!