Securing Telegram Bot Webhooks and Rate Limit Architecture

Because bot webhooks are publicly exposed HTTPS URLs, attackers can attempt spoofing fake update payloads or overloading your backend with denial-of-service traffic. Here is how we enforce zero-trust security on the Zentry platform.

1. Utilizing secret_token in setWebhook

Telegram allows developers to specify a secret_token parameter when configuring webhooks. Telegram sends this token in every update request via the X-Telegram-Bot-Api-Secret-Token header:

// Verifying incoming request header
const secretHeader = request.headers.get('X-Telegram-Bot-Api-Secret-Token');
if (secretHeader !== env.TELEGRAM_SECRET_TOKEN) {
  return new Response('Unauthorized', { status: 403 });
}

2. Telegram Subnet Whitelisting

Telegram delivers webhook requests strictly from their official subnets (149.154.160.0/20 and 91.108.4.0/22). Restricting your edge firewall rules to these CIDR blocks prevents unauthorized third parties from reaching your serverless functions.

3. Idempotency & Replay Defense

Telegram can retry webhook deliveries if your origin takes too long to respond. Store recent update_id integers in an in-memory cache or KV store for 60 seconds to guarantee idempotent processing.