[Bug]: isTMA returns invalid value when opening a link in the Telegram in-app browser on iOS

[nikitaprokopov]

Telegram Application

Telegram for Android, Telegram for iOS

Describe the Bug

When a user opens a link to our web app from Telegram on iOS, the app fails to load. Telegram opens the link in its built-in browser. However, the Telegram SDK's isTMA check incorrectly returns true, leading the app to assume it's running inside TMA and proceed with code that depends on the full TMA context - which causes a failure.

To Reproduce

Steps to reproduce the behavior:

1. On an iPhone, open the Telegram app.
2. Go to Settings > Data and Storage > Open Links In and select Telegram.
3. Tap a link to https://tma-sdk-bug-reproduce.netlify.app in any Telegram chat.
4. The link will open in the Telegram in-app browser.
5. isTma = true

A reproduction repository is available here.

Expected Behavior

The isTMA should correctly detect that it's not running in a true TMA environment, even when opened inside the Telegram in-app browser.

If changing the behavior of isTMA is not possible due to backward compatibility concerns, then it would be very helpful to have an additional function in the Telegram SDK that allows developers to explicitly distinguish between:

• The Telegram in-app browser (which is not a valid context for TMA logic)
• A true TMA environment, and

[heyqbnk]

The title is probably misleading a bit. Does this function crash the app or it just misbehaves?

The problem is in the Telegram client unfortunately. Async version of isTMA attempts to call a TMA method and waits for a response. So, in your case, the Telegram client adds his TMA ports into a non-mini app (web app in in-app browser) leading the function into assuming that the current environment is TMA. The client even communicates with this web app.

Not really sure, but you can try using both sync and async versions of isTMA in the same condition. If the behavior is still incorrect, I don't really know what can be done on SDK's side.

if (isTMA() && await isTMA('complete')) {
  // mini app
}

This issue was reported to the Telegram about 1.5 weeks ago

[nikitaprokopov]

The title is probably misleading a bit. Does this function crash the app or it just misbehaves?

You're right — sorry for the misleading title.

The isTMA function itself doesn't crash the app. The issue is that it returns true even when the app is opened in the Telegram in-app browser (not a real TMA environment). As a result, our production app proceeds with logic assuming it's inside a TMA, which leads to a crash

[nikitaprokopov]

if (isTMA() && await isTMA('complete')) {
// mini app
}

Huge thanks for the quick response - that code worked perfectly, and everything is functioning as expected now. Really appreciate the help!

[nikitaprokopov]

This issue was reported to the Telegram about 1.5 weeks ago

Could you please share a link to the issue you reported to Telegram?

[heyqbnk]

Could you please share a link to the issue you reported to Telegram?

This one was reported privately as long as I consider this problem as a vulnerability. It brings us some other kinds of problems in some specific scenarios