fix(security): timing attack, rate limiter за прокси, хардкод ID в скриптах (20.09.2026)

2026-09-20 17:49:58 +00:00
parent 67709cb6d2
commit e15a228f80
4 changed files with 87 additions and 23 deletions
@@ -58,7 +58,7 @@ async def verify_telegram_initdata(init_data: str):
            hashlib.sha256
        ).hexdigest()
        
-        if calculated_hash != received_hash:
+        if not hmac.compare_digest(calculated_hash, received_hash):
            raise HTTPException(401, "Invalid initData signature")
        
        # Извлекаем данные пользователя