---
title: "Open deep links only from verified domains · Agent Wranglers"
url: https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/verified-deep-links
id: MOB-44
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1115
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Open deep links only from verified domains

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Network, links and web views](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: MOB-44
- Level: Required
- Chapter: [Network, links and web views](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views.md)
- Rule: Links that open screens or carry tokens use verified Universal Links and Android App Links on https addresses you own. The app checks every link parameter against an allowlist before acting on it.
- Check: `adb shell pm get-app-links` shows `verified` for every app domain, and the iOS association file passes Apple's validator. A test opens a link with an unknown path and one with an outside URL parameter, and both land on the home screen.
- Risk: An account or system taken over
- How: Any app can register the same custom scheme, so a link such as `exampleapp://reset?token=…` may open in a hostile app. A verified link proves the domain belongs to your app. The files are in [open links in your iOS app](https://agentwranglers.se/playbook/website/standard-addresses/app-links.md) and [open links in your Android app](https://agentwranglers.se/playbook/website/standard-addresses/app-links.md). On Android, set `android:autoVerify="true"` on the intent filter and `android:exported="false"` on every activity that no other app should open. Publishing those files is optional for a website with no app. Once an app opens links, this rule applies to it. Treat a deep link as input from a stranger. Match the path to a fixed list of screens, never load a URL taken from a parameter, and check the session before showing private data. An action such as a payment or a change of email asks the person to confirm on screen, even when the link is valid.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Plain text example

```swift
enum Route { case order(String), home }

func route(for url: URL) -> Route {
    guard url.scheme == "https", url.host == "app.example.com" else { return .home }
    let parts = url.pathComponents
    if parts.count == 3, parts[1] == "orders", parts[2].allSatisfy(\.isNumber) { return .order(parts[2]) }
    return .home
}
```

### Kotlin example

```kotlin
sealed interface Route { data class Order(val id: String) : Route; data object Home : Route }

fun routeFor(uri: Uri): Route {
    if (uri.scheme != "https" || uri.host != "app.example.com") return Route.Home
    val parts = uri.pathSegments
    return if (parts.size == 2 && parts[0] == "orders" && parts[1].all(Char::isDigit)) Route.Order(parts[1]) else Route.Home
}
```

## Sources

- [Android, Unsafe use of deep links](https://developer.android.com/privacy-and-security/risks/unsafe-use-of-deeplinks)
- [Android, Verify App Links](https://developer.android.com/training/app-links/verify-android-applinks)
- [Apple, Supporting associated domains](https://developer.apple.com/documentation/xcode/supporting-associated-domains)

## Related rules

- WEB-178 [Open links in your phone apps](https://agentwranglers.se/playbook/website/standard-addresses/app-links.md) in Website
- MOB-43 [Sign in through the system browser with PKCE](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/system-browser-sign-in.md) in Mobile apps

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/verified-deep-links">Agent Wranglers mobile apps playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Sign in through the system browser with PKCE](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/system-browser-sign-in.md)
- Next: [Allow no cleartext traffic from the app](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/no-cleartext-traffic.md)
- [Network, links and web views](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views.md)