fix(utils): use hmac.compare_digest for secure WebApp signature validation (#1710)

2025-12-06 07:50:32 +00:00 · 2025-07-19 16:17:27 +05:00 · 2025-07-19 16:17:27 +05:00 · ddcedadfbd
commit ddcedadfbd
parent 7a517f1eba
2 changed files with 2 additions and 1 deletions
--- a/CHANGES/1709.bugfix.rst
+++ b/CHANGES/1709.bugfix.rst
@ -0,0 +1 @@
+Use `hmac.compare_digest` for validating WebApp data to prevent timing attacks.
--- a/aiogram/utils/web_app.py
+++ b/aiogram/utils/web_app.py
@ -134,7 +134,7 @@ def check_webapp_signature(token: str, init_data: str) -> bool:
    calculated_hash = hmac.new(
        key=secret_key.digest(), msg=data_check_string.encode(), digestmod=hashlib.sha256
    ).hexdigest()
-    return calculated_hash == hash_
+    return hmac.compare_digest(calculated_hash, hash_)


 def parse_webapp_init_data(
				`@ -0,0 +1 @@`
				Use `hmac.compare_digest` for validating WebApp data to prevent timing attacks.