telegram site auth

check_hash.py

# implementation of Telegram site authorization checking algorithm
# for more information https://core.telegram.org/widgets/login#checking-authorization

import collections
import hmac
import hashlib

def check_string(data, token):
    secret = hashlib.sha256()
    secret.update(token.encode('utf-8'))
    sorted_params = collections.OrderedDict(sorted(data.items()))
    param_hash = data.get('hash', '')
    msg = "\n".join(["{}={}".format(k, v) for k, v in sorted_params.items() if k != 'hash'])

    return param_hash == hmac.new(secret.digest(), msg.encode('utf-8'), digestmod=hashlib.sha256).hexdigest():