Android App Security · Components & Intents · Lesson 4 of 5

Deep Links

Find out how a tapped link picks an app, and how verified links stop impostors.

Links that open apps

Tap a shopping link in a text and it opens straight to the product inside the store's app, not its home screen. That's a deep link: a link that takes you to a specific place inside an app. Under the hood it's the implicit intent from module 2, with the action ACTION_VIEW and the link as its data. An app claims a link by adding an intent filter for it.

Deep links come in two styles.

• Custom scheme links invent their own prefix, like quicknotes://note/7. Only an app that registered that prefix can open them.
• Web links use ordinary https:// addresses, like https://quicknotes.example/n/7. Browsers can open these too, so the phone has to decide between the browser and any app that claims the address.

Here's the catch. Android lets more than one app register a filter for the same link. When that happens with a plain deep link, the system may show a disambiguation dialog, a small "Open with" box asking which app you want.

Android App Links solve this for web links. They're web links the app has proven it owns. The developer marks the intent filter with android:autoVerify="true", and the company's website publishes a small file at https://quicknotes.example/.well-known/assetlinks.json. That file, part of a system called Digital Asset Links, names the app's package and the SHA-256 fingerprint of its signing certificate. Android checks that the two sides agree.

Once verified, a tapped link opens the real app directly, with no dialog. App Links work on Android 6.0 and later on phones with Google services.

You saw this in the module 2 lab: the QuickNotes link opened the app without asking.

Hijacked links and safe habits

Since any app may claim any link in its manifest, an unverified link can be grabbed by the wrong app. This is called link hijacking. Imagine a fake app that registers quicknotes:// or a bank's sign-in address. If you tap a link and the fake app opens, it can show a convincing login page, or catch data the link was carrying, such as a one-time sign-in code.

Android 12 closed the biggest gap for web links. On Android 12 and later, a web link opens in an app only if that app is approved for the link's domain. There are two ways to get approved: verify the domain with App Links, or have the user turn it on for that app in system settings. If neither happened, the link simply opens in your default browser. Custom scheme links aren't covered by this, since there's no website to check them against.

For developers building their own apps, Google's advice boils down to a few habits:

• Use verified App Links for your web addresses instead of custom schemes.
• Never put secrets like passwords or long-lived tokens in a link.
• Treat every value in an incoming link as untrusted. Check it against what you expect.
• Check that the user is signed in and allowed to act before a link does anything sensitive.

For everyday users, the habits are simpler. If tapping a link opens an app you didn't expect, or a "browser" that asks for your password, back out and open the real app or site yourself. On Pixel and many other phones, each app's settings page has an Open by default section that shows which links the app may open, and you can switch them off there.