Telegram Web Bots data validation in JavaScript

I've tried to do user verification script for telegram web app for bots. I have no idea how to fix it.

import sha256 from 'js-sha256' const telegram = window.Telegram.WebApp const bot_token = '<bot-token>' const data_check_string = telegram.initData var secret_key = sha256.hmac.create(bot_token).update("WebAppData") var hash = sha256.hmac.create(data_check_string).update(secret_key).hex(); if ( hash == telegram.initDataUnsafe.hash) { // data is from Telegram } 

2 Answers

Try to look to node js implementation, I tried to well comment it using official telegram pseudocode. Maybe it helps you.

But in my convinience this validation need to execute at backend because in another case you compromise your bot secret token

The stated code to be used for validation in the official documentation is this:

data_check_string = ... secret_key = HMAC_SHA256(<bot_token>, "WebAppData") if (hex(HMAC_SHA256(data_check_string, secret_key)) == hash) { // data is from Telegram } 

please try to implement it as it is documented.

The link referring to this problem is: Telegram API validation