Data-check-string

[bugrevealingbme]

Validating data received via the Mini App

How do I go about checking the data?

Data-check-string is a chain of all retrieved fields, alphabetized in the format key=, with the line feed character ('\n', 0x0A) used as a separator - for example, 'auth_date=\nquery_id=\nuser='.

how can I get this?

[bugrevealingbme]

I've been trying for hours and I haven't been able to verify this data. Fuck Telegram

[khamidjon-khamidov]

@bugrevealingbme The string is in TelegramWebApp.instance.initData.raw

[bugrevealingbme]

I do not have .raw

[khamidjon-khamidov]

In telegram_init_data.dart file, there is TelegramInitData class which contains raw in the library. You can access this variable via TelegramWebApp.instance.initData.raw. But this is not sorted fields (it is just what is provided by telegram in the web app. When backend receives it, backend should decode, sort and remove hash field. Then calculate hashes.

Here is example how it was transformed in backend https://stackoverflow.com/a/78441046/11984583.

But you should not do this on the client side

[bugrevealingbme]

Am I using the wrong package or is it the old version in pub.dev? https://pub.dev/packages/telegram_web_app

[khamidjon-khamidov]

@bugrevealingbme Sorry forgot to update with my local changes. Please check the same package with version telegram_web_app 0.1.2

[bugrevealingbme]

not sure what changed but the plugin is broken

[bugrevealingbme]

[bugrevealingbme]

I downgraded and the problem was solved. I think this plugin is very important, could you please test it on the release version before you release it?

[khamidjon-khamidov]

Great thanks). We are using this plugin in our production software. But I will try to test every time

[bugrevealingbme]

Thank you, I am waiting for the new version. Also, does the start_param value work in version 0.1.0? I couldn't get it for some reason, how exactly do I use it?

[khamidjon-khamidov]

You can also ask topics in @flutter_telegram telegram channel.

Could you provide reproducing steps when the new version is causing the issue? As I said, latest version in my production code is working fine.

Regarding start_param, you can start mini app with param int.me/{botUsername}/{miniAppName}?startapp={param}. For example:t.me/bozorbop_bot/bozorchi?startapp=m402. You can access the variable via WebAppInitData::{start_param}.

There is another field tgWebAppStartParam with same functionality. But there is a known issue with this.

[bugrevealingbme]

I don't do anything extra in the new version. Any call from TelegramWebApp.instance.initData directly breaks it.

I call start_param from initDataUnsafe but I can't get any data, the link I used: https://t.me/haw_haw_bot/theapp?start=165387110

TelegramWebApp.instance.initDataUnsafe?.start_param

[bugrevealingbme]

maybe it is broken to start_param in version 0.1.0. But I can't use 0.1.2

[bugrevealingbme]

Have you tried running the package as telegram_web_app: ^0.1.2 instead of local?

[khamidjon-khamidov]

Okay will check it today evening

[bugrevealingbme]

Thanks, I am waiting to publish my application. Thank you for the package

[khamidjon-khamidov]

I am closing this as it is resloved