Skip to content

Conversation

talesam
Copy link

@talesam talesam commented Feb 13, 2025

Currently, the Telegram bot functionality is broken due to authentication requirements on the webhook endpoint. This PR fixes the issue by bypassing authentication specifically for Telegram webhook requests.

Problem:
The Telegram bot's webhook requests are being blocked by the panel's authentication middleware, resulting in HTTP 500 errors. This happens because Telegram's servers cannot provide the authentication credentials required by our middleware.

Technical Details:

  • Telegram sends webhook requests as unauthenticated POST requests to our endpoint
  • Telegram does not support sending custom authentication headers with webhook requests
  • The current middleware forces authentication for all routes, causing webhook requests to fail
  • This results in the bot being unable to receive and process messages from users

Solution:
Added a specific exception in the base_middleware to bypass authentication for Telegram webhook requests. This is a secure approach because:

  1. It only affects POST requests to the specific bot endpoint
  2. Telegram provides its own verification through the bot token
  3. The webhook URL contains a UUID which acts as an additional security measure

Alternative approaches considered:

  • Adding authentication to webhook requests: Not possible as Telegram doesn't support custom headers in webhooks
  • Using a separate endpoint: Would require significant architectural changes

Testing:

  • Webhook now receives requests successfully
  • Bot responds to commands as expected
  • Other authenticated routes remain secure

@talesam
Copy link
Author

talesam commented Feb 14, 2025

@Iam54r1n4 Could you check my PR? I had opened an Issue saying there was a problem with the bot, they ignored me, so I went after solving the problem.

@talesam
Copy link
Author

talesam commented Feb 15, 2025

@HiddifyOfficial See!

@hiddify-com
Copy link
Contributor

This line will create a security issue

the requests should be within the proxy path otherwise it may creates an issue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants