Open deep links only from verified domains

How to do it

Any app can register the same custom scheme, so a link such as exampleapp://reset?token=… may open in a hostile app. A verified link proves the domain belongs to your app. The files are in open links in your iOS app and open links in your Android app. On Android, set android:autoVerify="true" on the intent filter and android:exported="false" on every activity that no other app should open. Publishing those files is optional for a website with no app. Once an app opens links, this rule applies to it. Treat a deep link as input from a stranger. Match the path to a fixed list of screens, never load a URL taken from a parameter, and check the session before showing private data. An action such as a payment or a change of email asks the person to confirm on screen, even when the link is valid.

Examples

Plain text example

enum Route { case order(String), home }

func route(for url: URL) -> Route {
    guard url.scheme == "https", url.host == "app.example.com" else { return .home }
    let parts = url.pathComponents
    if parts.count == 3, parts[1] == "orders", parts[2].allSatisfy(\.isNumber) { return .order(parts[2]) }
    return .home
}

Kotlin example

sealed interface Route { data class Order(val id: String) : Route; data object Home : Route }

fun routeFor(uri: Uri): Route {
    if (uri.scheme != "https" || uri.host != "app.example.com") return Route.Home
    val parts = uri.pathSegments
    return if (parts.size == 2 && parts[0] == "orders" && parts[1].all(Char::isDigit)) Route.Order(parts[1]) else Route.Home
}

How to check

adb shell pm get-app-links shows verified for every app domain, and the iOS association file passes Apple's validator. A test opens a link with an unknown path and one with an outside URL parameter, and both land on the home screen.

Sources

• Android, Unsafe use of deep links
• Android, Verify App Links
• Apple, Supporting associated domains

Related rules

• WEB-178 Open links in your phone apps in Website
• MOB-43 Sign in through the system browser with PKCE in Mobile apps