Separating Identity and Delivery Channels for Compliant Telegram Mini App Authentication
When configuring authorization in Telegram Mini Apps, the initial flow appears straightforward: Telegram supplies initData, the server validates the HMAC-SHA-256 signature derived from the bot token, and everything works out of the box. However, services aimed at Russian users must also satisfy stricter identification requirements, prompting the team to keep Telegram primarily as a delivery channel rather than the sole login method.
The architecture explicitly separates two concepts: “who the user is” (identity) and “where to send notifications” (channel identity). Users authenticate via VK ID, Yandex ID or MAX, after which their telegram_id is linked to the account solely for message delivery. The database schema reflects this split with separate tables storing max_user_id, vk_user_id, yandex_id for identity and max_chat_id, vk_chat_id, telegram_id for delivery channels.
Three buttons labeled MAX, VK and Yandex appear inside the mini-app; no “Login with Telegram” option exists. For VK ID the team uses OAuth 2.1 with PKCE: the browser generates a code_verifier, computes the S256 code_challenge, and includes both state and challenge in the authorization request. The server stores the verifier keyed by state for later validation.
Authorization opens in a new browser tab, allowing users to complete the flow in their main browser even when the mini-app runs inside Telegram WebView or on another device. After success the tab closes itself and the main interface learns the outcome via polling. The same pattern was applied to smart-home authorization through Home Assistant.
Yandex authentication follows a similar OAuth 2.0 flow, but the authorization URL is generated on the backend. The server exchanges the received code for an access token, retrieves the user identifier, and returns the result via a /api/auth/result-by-state endpoint that clients poll (for example, 120 attempts at three-second intervals). Only a short-lived application-level code travels to the browser; the OAuth token itself never reaches client JavaScript and is instead stored in an HttpOnly cookie, reducing XSS exposure.
State values are generated with crypto.randomUUID() or crypto.getRandomValues() providing at least 128 bits of entropy and are stored server-side with a short TTL. The callback avoids placing any auth_token in the URL; a one-time code is exchanged for a session via POST. A from_extension flag is passed only for UI adjustments and carries no security meaning on the server.
MAX integration uses a deep link containing a single-use token; after binding, the bot posts a confirmation message in the chat. Consent handling differs by platform: Telegram WebApp versions display two checkboxes (general consent and separate consent for data transfer to Telegram) to meet legal requirements, while the PWA version requires only one checkbox.
The resulting system powers the project “My Anti-Social Network,” an ad-free news aggregator that includes bots in Telegram, MAX and VK, a PWA, browser extensions, mobile apps and integrations with smart-home and voice assistants. The developer notes that while the technical pattern supports compliance, final legal validity depends on specific regulatory interpretation.
Related articles
Kubernetes Audit Policy Review: Checklist Targets Common Blind Spots in Rules
An experienced Kubernetes administrator shared a detailed review process for audit policies that often remain untouched for years after initial deployment. The 580-line policy was rebuilt using the Kubernetes Threat Matrix from RedGuard as the primary reference. The author highlights recurring issues such as outdated exceptions, missing coverage for new components, and legacy comments that obscure actual security intent. The resulting checklist focuses on principles rather than cluster-specific findings to help other teams perform effective policy audits. Key recommendations address rule completeness, exception management, and periodic full-scale reviews instead of incremental patching. The approach aims to restore audit policies as active security controls rather than accumulated technical debt.
Avoiding a Leaky Kubernetes Audit Policy: Real-World Configuration Breakdown
Kubernetes Audit Policy is typically configured once during cluster setup and then left untouched for years while accumulating exceptions for new components. Over time the policy stops functioning as a security control and instead becomes an archaeological layer of outdated comments such as "# temporary, TODO remove" that date back three years or more. The author recently reviewed their own 580-line configuration file that had been assembled from multiple sources. Primary reference was the Kubernetes Threat Matrix, which explains why many rules are designed to detect security-relevant actions rather than simply reduce log noise. Examples include targeted monitoring of RBAC modifications and deletion of events. The article emphasizes the need for periodic full reviews instead of incremental patching to maintain effective detection coverage.
CryptoPro Develops CryptoPro-Browser with Russian Cryptography for FSB Compliance
CryptoPro is creating its own browser called CryptoPro-Browser as part of the CryptoPro CSP 6.0 cryptographic information protection system. The product will include built-in cryptographic tools, support for the company's plugin, and TLS connections using Russian cryptographic algorithms. The development follows Google's removal of the CryptoPro extension from the Chrome Web Store in February 2025, which left new users without an easy installation method. The project has been coordinated with the FSB of Russia and targets scenarios requiring compliance with Russian information security regulations. CryptoPro plans to incorporate experience from its earlier Chromium-Gost project started in 2017, while also recommending Yandex Browser as an alternative. Analysts estimate the development cost at several tens of millions of rubles, with the main focus on corporate customers needing certificate management and specialized support.
Yandex 360 Email Archive Documentation Shows Search Snapshots and Former Employee Log Filters
The Yandex 360 administrator guide describes the email archive as a tool that stores copies of all messages sent and received by employees on the organization's domain. Two specific statements in the documentation indicate that each saved search returns a static snapshot that does not update automatically when new mail arrives, requiring manual cloning or recreation of the search to obtain current results. The same documentation states that the action log records every operation performed in the archive, yet the employee filter in the log interface only displays currently active accounts, making it impossible to select a former administrator by name. API 360 currently provides no documented endpoints for creating, executing, or retrieving archive searches, leaving all operations dependent on the web console. Additional notes clarify that messages remain available after an account is blocked but disappear once the account is deleted, and that messages removed before the archive was enabled cannot be recovered. These documented behaviors directly affect incident response and offboarding procedures that rely on historical email retrieval and audit trails.