Documentation
¶
Overview ¶
Package tgwebapp verifies Telegram Web App initData payloads.
Telegram Web Apps deliver an HMAC-signed initData string to the page that the bot's web_app button opens. The signature is derived from the bot token, so any server holding the bot token can authenticate the user without a password. This package implements the verification algorithm from https://core.telegram.org/bots/webapps#validating-data-received-via-the-mini-app.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type User ¶
type User struct {
ID int64 `json:"id"`
Username string `json:"username,omitempty"`
FirstName string `json:"first_name,omitempty"`
LastName string `json:"last_name,omitempty"`
}
User is the subset of Telegram's WebAppUser that callers care about.
func Verify ¶
Verify validates a Telegram Web App initData string against botToken. The algorithm:
- Parse initData as application/x-www-form-urlencoded.
- Remove the `hash` field; sort remaining fields alphabetically and join them as "k=v\nk=v\n..." (data_check_string).
- secret_key = HMAC-SHA256(key="WebAppData", msg=botToken).
- expected = hex(HMAC-SHA256(key=secret_key, msg=data_check_string)).
- Constant-time compare with the `hash` field.
- Enforce now - auth_date <= maxAge.
- Decode the `user` field (a JSON object) into User.
Returns the parsed User on success.
Source Files
Click to show internal directories.
Click to hide internal directories.