Deep Linking Security: Preventing Hijacking and Abuse

A deep link is a door into your app. If you do not secure it, attackers can exploit it. Custom URL scheme hijacking, deep link phishing, server-side request forgery via redirect URLs, and parameter injection are all real attack vectors. This guide covers the security risks and how to defend against them.

For privacy considerations, see deep linking and privacy: what you need to know. For general deep linking challenges, see common deep linking challenges and how to solve them.

Attack Vectors

1. Custom URL Scheme Hijacking

The attack: On iOS, any app can register any custom URL scheme. A malicious app registers bankapp:// and intercepts URLs meant for the real banking app. It could capture sensitive parameters like authentication tokens, transaction IDs, or user identifiers.

Risk level: High for apps using custom URL schemes with sensitive data.

Defense: Use Universal Links instead of custom URL schemes. Universal Links require domain verification via the AASA file, which proves that the app developer controls the domain. Only one app can be verified for a given domain.

// BAD: Custom scheme with sensitive data
// myapp://reset-password?token=abc123
// Any app registering "myapp://" could intercept this token

// GOOD: Universal Link with domain verification
// https://app.example.com/reset-password?token=abc123
// Only the verified app opens this URL

2. Deep Link Phishing

The attack: An attacker sends a user a legitimate-looking deep link that opens the real app but with malicious parameters. For example:

https://app.example.com/transfer?to=attacker-account&amount=1000

If the app blindly executes the transfer without confirmation, the user loses money.

Risk level: High for apps that perform actions from deep link parameters.

Defense: Never execute sensitive actions directly from deep link parameters. Always require user confirmation.

func handleDeepLink(_ url: URL) {
    guard let components = URLComponents(url: url, resolvingAgainstBaseURL: false) else { return }

    if components.path == "/transfer" {
        let to = components.queryItems?.first(where: { $0.name == "to" })?.value
        let amount = components.queryItems?.first(where: { $0.name == "amount" })?.value

        // DO NOT execute transfer directly
        // Instead, show a confirmation screen
        showTransferConfirmation(to: to, amount: amount)
    }
}

3. Parameter Injection

The attack: An attacker crafts a deep link with parameters designed to exploit the app's logic:

https://app.example.com/search?q=<script>alert('xss')</script>
https://app.example.com/profile?id=../../admin
https://app.example.com/redirect?url=https://evil.com

Risk level: Medium. Mobile apps are less susceptible to XSS than web apps, but WebViews within apps can be vulnerable.

Defense: Validate and sanitize all parameters from deep links.

function validateDeepLinkParams(params: URLSearchParams): boolean {
  // Whitelist allowed parameters
  const allowedParams = ['id', 'ref', 'campaign', 'q'];
  for (const [key] of params) {
    if (!allowedParams.includes(key)) {
      console.warn(`Unexpected parameter: ${key}`);
      return false;
    }
  }

  // Validate parameter formats
  const id = params.get('id');
  if (id && !/^[a-zA-Z0-9_-]+$/.test(id)) {
    console.warn(`Invalid ID format: ${id}`);
    return false;
  }

  // Block redirect URLs to external domains
  const redirectUrl = params.get('url');
  if (redirectUrl) {
    const url = new URL(redirectUrl);
    if (url.hostname !== 'app.example.com') {
      console.warn(`Blocked external redirect: ${redirectUrl}`);
      return false;
    }
  }

  return true;
}

4. Open Redirect

The attack: If your deep link handler redirects to a URL specified in a parameter, attackers can use your domain for phishing:

https://app.example.com/redirect?to=https://evil-site.com/fake-login

The victim sees app.example.com in the link, trusts it, and ends up on the attacker's phishing page.

Risk level: High. This is an OWASP Top 10 vulnerability.

Defense: Never redirect to user-supplied URLs. If you must redirect, validate against a whitelist of allowed domains.

const ALLOWED_REDIRECT_DOMAINS = [
  'app.example.com',
  'www.example.com',
  'docs.example.com'
];

function safeRedirect(targetUrl: string, fallback: string): string {
  try {
    const url = new URL(targetUrl);
    if (ALLOWED_REDIRECT_DOMAINS.includes(url.hostname)) {
      return targetUrl;
    }
  } catch {
    // Invalid URL
  }
  return fallback;
}

5. Link Token Enumeration

The attack: If your deep links use sequential or predictable tokens, attackers can enumerate them:

https://app.example.com/invite/001
https://app.example.com/invite/002
https://app.example.com/invite/003  (trying to find valid invite codes)

Risk level: Medium. Depends on what the tokens grant access to.

Defense: Use cryptographically random tokens.

import { randomBytes } from 'crypto';

function generateDeepLinkToken(): string {
  // 128-bit random token, URL-safe base64
  return randomBytes(16).toString('base64url');
  // Result: something like "dGhpcyBpcyBhIHRlc3Q"
}

Security Best Practices

1. Prefer Universal Links / App Links

Universal Links and App Links are inherently more secure than custom URL schemes because they require domain verification. Only the app that controls the domain (proven via AASA or assetlinks.json) can handle the URLs.

Feature	Custom URL Scheme	Universal Links / App Links
Ownership verification	None	Domain verification required
Hijacking possible	Yes	No (one verified app per domain)
HTTPS encryption	No (custom scheme)	Yes
Web fallback	No	Yes

2. Validate All Input

Treat every deep link URL as untrusted input, regardless of where it came from:

func handleDeepLink(_ url: URL) {
    // 1. Verify the scheme and host
    guard url.scheme == "https",
          url.host == "app.example.com" else {
        return
    }

    // 2. Parse and validate the path
    let pathComponents = url.pathComponents.filter { $0 != "/" }
    guard pathComponents.count >= 1,
          pathComponents.count <= 5 else {
        return // Reject abnormally long paths
    }

    // 3. Validate each parameter
    guard let components = URLComponents(url: url, resolvingAgainstBaseURL: false) else { return }
    for item in components.queryItems ?? [] {
        guard item.value?.count ?? 0 <= 256 else {
            return // Reject abnormally long values
        }
    }

    // 4. Route to the handler
    router.handle(url)
}

3. Use Signed Deep Links for Sensitive Operations

For deep links that grant access to sensitive content (password reset, email verification, payment confirmation), sign the URL with a secret:

import { createHmac } from 'crypto';

function signDeepLink(url: string, secret: string): string {
  const signature = createHmac('sha256', secret)
    .update(url)
    .digest('hex')
    .substring(0, 16);

  const separator = url.includes('?') ? '&' : '?';
  return `${url}${separator}sig=${signature}`;
}

function verifyDeepLink(url: string, secret: string): boolean {
  const urlObj = new URL(url);
  const sig = urlObj.searchParams.get('sig');
  if (!sig) return false;

  urlObj.searchParams.delete('sig');
  const expected = createHmac('sha256', secret)
    .update(urlObj.toString())
    .digest('hex')
    .substring(0, 16);

  return sig === expected;
}

// Generate: https://app.example.com/reset-password?token=abc123&sig=a1b2c3d4e5f6g7h8
// Verify on the app side before processing

4. Expire Deep Link Tokens

Deep link tokens should have a limited lifetime:

interface DeepLinkToken {
  token: string;
  createdAt: Date;
  expiresAt: Date;
  used: boolean;
  purpose: 'password_reset' | 'email_verify' | 'invite';
}

function validateToken(token: DeepLinkToken): boolean {
  if (token.used) return false;              // Single use
  if (token.expiresAt < new Date()) return false;  // Expired
  return true;
}

Purpose	Recommended Expiry
Password reset	1 hour
Email verification	24 hours
Invite link	7 days
Referral link	30 days
Content deep link	No expiry needed

5. Rate Limit Deep Link Resolution

Protect your deep link server from enumeration and abuse:

import rateLimit from 'express-rate-limit';

const deepLinkLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,  // 15 minutes
  max: 100,                   // 100 requests per window
  standardHeaders: true,
  legacyHeaders: false,
  message: 'Too many requests'
});

app.use('/links', deepLinkLimiter);

6. Log Deep Link Access

Monitor for suspicious patterns:

function logDeepLinkAccess(req: Request, deepLink: DeepLink) {
  const logEntry = {
    timestamp: new Date().toISOString(),
    ip: req.ip,
    userAgent: req.headers['user-agent'],
    url: req.url,
    deepLinkId: deepLink.id,
    outcome: deepLink.resolved ? 'resolved' : 'failed'
  };

  // Detect suspicious patterns
  if (isRapidAccess(req.ip, deepLink.id)) {
    flagForReview(logEntry);
  }

  analytics.log(logEntry);
}

WebView Security

If your deep link opens content in a WebView (common for hybrid apps), additional precautions apply:

// iOS WKWebView security configuration
let config = WKWebViewConfiguration()

// Disable JavaScript if not needed
config.preferences.javaScriptEnabled = false

// Restrict navigation to your domain
func webView(_ webView: WKWebView,
             decidePolicyFor navigationAction: WKNavigationAction,
             decisionHandler: @escaping (WKNavigationActionPolicy) -> Void) {
    guard let url = navigationAction.request.url,
          url.host == "app.example.com" else {
        decisionHandler(.cancel) // Block navigation to other domains
        return
    }
    decisionHandler(.allow)
}

Tolinku for Secure Deep Linking

Tolinku uses Universal Links and App Links exclusively (no custom URL schemes), providing domain-verified deep linking. See the Universal Links documentation for security details.

For privacy, see deep linking and privacy: what you need to know. For the full guide, see the complete guide to deep linking in 2026.