can elma
back to all notes

backend1 min read

Using a Telegram Bot as a File Backend Without Exposing the Token

Telegram file URLs contain the bot token. Using those URLs directly on a public website would expose that credential, so I wrote a Go proxy to serve the files instead.

Source repository: telegram-file-backend.

The proxy uses the Telegram Bot API and Redis for caching and state. A Python utility encrypts the bot token with AES; clients use the encrypted value and a file ID in the proxy URL.

Running it

  1. Encrypt the bot token with the provided utility: 
    python encryptor/encrypt.py 'YOUR_BOT_TOKEN' # Output: encrypted token
  2. Start Redis.
  3. Run the Go proxy.
  4. Request files through its endpoint: 
    http://localhost:4627/<ENCRYPTED_BOT_TOKEN>/<FILE_ID>

Keeping the plaintext token out of a public URL is useful, but encryption alone does not establish access control for the proxy. Anyone holding an accepted encrypted URL may still be able to use it.