Telegram authentication stratery

[vheathen]

Telegram offers a convenient way of authenticating users by allowing them to enter their Telegram-linked phone number and confirm the request directly in the Telegram messenger app without a password.

However, they don’t support the traditional method of redirecting to their OAuth server to enter credentials. Instead, it is necessary to include their JS library on the page and either use an embedded iframe with a standard button (with limited styles) or - via an undocumented method - directly call the library's auth(callback) function with a callback to get the results. The official login widget also supports the redirect mode to a provided callback URL. This means that the authorize_url/1 call is useless for this implementation (more on this later).

Additionally, Telegram has published the Web Mini App API. This API allows direct interaction with many internal Telegram features. The Mini Web App is intended to be opened directly from the messenger app and to work inside the app.

To authenticate a user of a web app, Telegram sends a URL-encoded query string (protected by a hash) that contains all the initial data when opening the web app. This string doesn’t pass through a WebView instance and should be collected inside the frontend and sent to the backend for authentication. The backend needs to check the data’s authenticity by calculating the hash of the string and comparing it with the provided one, as well as validating the authentication date.

#152 implements the strategy.

Returning to the authorization_url/1: it is possible to use it to create a script to embed in the HTML page. The generator, depending on config parameters, can then generate different embedding options. However, this contradicts the direct meaning of authorization_url call.

WDYT?