docs: הוספת מדריך סנכרון בזמן אמת ואימות בטלגרם - #3128
Conversation
פוסט שמסביר שני נושאים מרכזיים בארכיטקטורה: 1. סנכרון בין בוט טלגרם ל-Web App באמצעות DB משותף ושכבת Repository אחידה 2. אימות משתמשים ב-Web App דרך Telegram Login Widget ו-Token חד-פעמי https://claude.ai/code/session_019AtMGvdXX68pMCGrSiKFEr
🧯 Dangerous deletes guard reportPolicy: see .cursorrules — dangerous deletions are blocked unless wrapped safely. Summary:
Flagged findings (file:line:snippet): Excluded matches (by path pattern) |
⏱️ Performance report(No performance test durations collected. Mark tests with |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0f89740029
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| token_data = f"{user_id}:{int(time.time())}:{secret}" | ||
| auth_token = hashlib.sha256(token_data.encode()).hexdigest()[:32] |
There was a problem hiding this comment.
The token in build_login_payload is deterministic (user_id + current second + secret), so multiple login-link requests from the same user within the same second produce the exact same token. That breaks the “one-time” guarantee described in the doc because duplicate DB rows can exist for one token, allowing the same URL to be accepted repeatedly until all duplicates are consumed; use a cryptographically random nonce (for example secrets.token_urlsafe) and enforce uniqueness on the token field.
Useful? React with 👍 / 👎.
| token_doc = db.webapp_tokens.find_one({ | ||
| "token": token, | ||
| "user_id": int(user_id) | ||
| }) |
There was a problem hiding this comment.
The flow first reads the token document and only later deletes it, which creates a race where two parallel requests with the same URL can both pass find_one before either deletion runs, resulting in multiple valid sessions from one supposedly single-use token. Document this as an atomic find_one_and_delete (with token, user, and expiry conditions) so only one request can successfully consume the token.
Useful? React with 👍 / 👎.
📖 Documentation PreviewThe documentation has been built successfully!
To view locally:
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
| ).hexdigest() | ||
|
|
||
| # השוואה + בדיקת תוקף זמן (עד שעה) | ||
| if calculated_hash != check_hash: |
There was a problem hiding this comment.
HMAC hash comparison vulnerable to timing attacks
High Severity
The verify_telegram_auth code example uses calculated_hash != check_hash (direct string comparison) instead of hmac.compare_digest(calculated_hash, check_hash). Direct != comparison is vulnerable to timing attacks because it short-circuits on the first differing byte, allowing attackers to infer the correct hash incrementally. Since this guide explicitly teaches "secure authentication" and the hmac module is already imported, the constant-time hmac.compare_digest() function is the correct choice here.
| return "קישור פג תוקף", 401 | ||
|
|
||
| # מחיקה אחרי שימוש — חד פעמי! | ||
| db.webapp_tokens.delete_one({"_id": token_doc["_id"]}) |
There was a problem hiding this comment.
Token auth has TOCTOU race allowing reuse
Medium Severity
The one-time token verification uses separate find_one and delete_one calls, creating a TOCTOU (time-of-check-time-of-use) race condition. Two concurrent requests with the same token can both pass the find_one check before either executes delete_one, defeating the "one-time use" guarantee the guide emphasizes. MongoDB's atomic find_one_and_delete is the correct approach for consuming one-time tokens.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
2 participants
✨ תיאור קצר
הוספת מדריך תיעוד מקיף בעברית המסביר כיצד לממש סנכרון בזמן אמת בין Telegram Bot ל-Web App, וכיצד לאמת משתמשים בצורה מאובטחת באמצעות Telegram Login Widget וטוקנים חד-פעמיים.
📦 שינויים עיקריים
פירוט:
docs/blog/sync-and-auth-telegram-webapp.md(301 שורות)🧪 בדיקות
📝 סוג שינוי
✅ צ'קליסט
🧩 השפעות/סיכונים
🔗 קישורים
docs/blog/sync-and-auth-telegram-webapp.mdhttps://claude.ai/code/session_019AtMGvdXX68pMCGrSiKFEr