A deep link is a door into your app. If you do not secure it, attackers can exploit it. Custom URL scheme hijacking, deep link phishing, server-side request forgery via redirect URLs, and parameter injection are all real attack vectors. This guide covers the security risks and how to defend against them.<\/p>\n\n\n\n
For privacy considerations, see deep linking and privacy: what you need to know<\/a>. For general deep linking challenges, see common deep linking challenges and how to solve them<\/a>.<\/p>\n\n\n\n The attack:<\/strong> On iOS, any app can register any custom URL scheme. A malicious app registers Risk level:<\/strong> High for apps using custom URL schemes with sensitive data.<\/p>\n\n\n\n Defense:<\/strong> Use Universal Links instead of custom URL schemes. Universal Links require domain verification via the AASA file, which proves that the app developer controls the domain. Only one app can be verified for a given domain.<\/p>\n\n\n\n The attack:<\/strong> An attacker sends a user a legitimate-looking deep link that opens the real app but with malicious parameters. For example:<\/p>\n\n\n\n If the app blindly executes the transfer without confirmation, the user loses money.<\/p>\n\n\n\n Risk level:<\/strong> High for apps that perform actions from deep link parameters.<\/p>\n\n\n\n Defense:<\/strong> Never execute sensitive actions directly from deep link parameters. Always require user confirmation.<\/p>\n\n\n\n The attack:<\/strong> An attacker crafts a deep link with parameters designed to exploit the app's logic:<\/p>\n\n\n\n Risk level:<\/strong> Medium. Mobile apps are less susceptible to XSS than web apps, but WebViews within apps can be vulnerable.<\/p>\n\n\n\n Defense:<\/strong> Validate and sanitize all parameters from deep links.<\/p>\n\n\n\n The attack:<\/strong> If your deep link handler redirects to a URL specified in a parameter, attackers can use your domain for phishing:<\/p>\n\n\n\n The victim sees Risk level:<\/strong> High. This is an OWASP Top 10<\/a> vulnerability.<\/p>\n\n\n\n Defense:<\/strong> Never redirect to user-supplied URLs. If you must redirect, validate against a whitelist of allowed domains.<\/p>\n\n\n\n The attack:<\/strong> If your deep links use sequential or predictable tokens, attackers can enumerate them:<\/p>\n\n\n\n Risk level:<\/strong> Medium. Depends on what the tokens grant access to.<\/p>\n\n\n\n Defense:<\/strong> Use cryptographically random tokens.<\/p>\n\n\n\n Universal Links and App Links are inherently more secure than custom URL schemes because they require domain verification. Only the app that controls the domain (proven via AASA or assetlinks.json) can handle the URLs.<\/p>\n\n\n\nAttack Vectors<\/h2>\n\n\n\n
1. Custom URL Scheme Hijacking<\/h3>\n\n\n\n
bankapp:\/\/<\/code> and intercepts URLs meant for the real banking app. It could capture sensitive parameters like authentication tokens, transaction IDs, or user identifiers.<\/p>\n\n\n\n\/\/ BAD: Custom scheme with sensitive data\n\/\/ myapp:\/\/reset-password?token=abc123\n\/\/ Any app registering "myapp:\/\/" could intercept this token\n\n\/\/ GOOD: Universal Link with domain verification\n\/\/ https:\/\/app.example.com\/reset-password?token=abc123\n\/\/ Only the verified app opens this URL\n<\/code><\/pre>\n\n\n\n2. Deep Link Phishing<\/h3>\n\n\n\n
https:\/\/app.example.com\/transfer?to=attacker-account&amount=1000\n<\/code><\/pre>\n\n\n\nfunc handleDeepLink(_ url: URL) {\n guard let components = URLComponents(url: url, resolvingAgainstBaseURL: false) else { return }\n\n if components.path == "\/transfer" {\n let to = components.queryItems?.first(where: { $0.name == "to" })?.value\n let amount = components.queryItems?.first(where: { $0.name == "amount" })?.value\n\n \/\/ DO NOT execute transfer directly\n \/\/ Instead, show a confirmation screen\n showTransferConfirmation(to: to, amount: amount)\n }\n}\n<\/code><\/pre>\n\n\n\n3. Parameter Injection<\/h3>\n\n\n\n
https:\/\/app.example.com\/search?q=<script>alert('xss')<\/script>\nhttps:\/\/app.example.com\/profile?id=..\/..\/admin\nhttps:\/\/app.example.com\/redirect?url=https:\/\/evil.com\n<\/code><\/pre>\n\n\n\nfunction validateDeepLinkParams(params: URLSearchParams): boolean {\n \/\/ Whitelist allowed parameters\n const allowedParams = ['id', 'ref', 'campaign', 'q'];\n for (const [key] of params) {\n if (!allowedParams.includes(key)) {\n console.warn(`Unexpected parameter: ${key}`);\n return false;\n }\n }\n\n \/\/ Validate parameter formats\n const id = params.get('id');\n if (id && !\/^[a-zA-Z0-9_-]+$\/.test(id)) {\n console.warn(`Invalid ID format: ${id}`);\n return false;\n }\n\n \/\/ Block redirect URLs to external domains\n const redirectUrl = params.get('url');\n if (redirectUrl) {\n const url = new URL(redirectUrl);\n if (url.hostname !== 'app.example.com') {\n console.warn(`Blocked external redirect: ${redirectUrl}`);\n return false;\n }\n }\n\n return true;\n}\n<\/code><\/pre>\n\n\n\n4. Open Redirect<\/h3>\n\n\n\n
https:\/\/app.example.com\/redirect?to=https:\/\/evil-site.com\/fake-login\n<\/code><\/pre>\n\n\n\napp.example.com<\/code> in the link, trusts it, and ends up on the attacker's phishing page.<\/p>\n\n\n\nconst ALLOWED_REDIRECT_DOMAINS = [\n 'app.example.com',\n 'www.example.com',\n 'docs.example.com'\n];\n\nfunction safeRedirect(targetUrl: string, fallback: string): string {\n try {\n const url = new URL(targetUrl);\n if (ALLOWED_REDIRECT_DOMAINS.includes(url.hostname)) {\n return targetUrl;\n }\n } catch {\n \/\/ Invalid URL\n }\n return fallback;\n}\n<\/code><\/pre>\n\n\n\n5. Link Token Enumeration<\/h3>\n\n\n\n
https:\/\/app.example.com\/invite\/001\nhttps:\/\/app.example.com\/invite\/002\nhttps:\/\/app.example.com\/invite\/003 (trying to find valid invite codes)\n<\/code><\/pre>\n\n\n\nimport { randomBytes } from 'crypto';\n\nfunction generateDeepLinkToken(): string {\n \/\/ 128-bit random token, URL-safe base64\n return randomBytes(16).toString('base64url');\n \/\/ Result: something like "dGhpcyBpcyBhIHRlc3Q"\n}\n<\/code><\/pre>\n\n\n\nSecurity Best Practices<\/h2>\n\n\n\n
1. Prefer Universal Links \/ App Links<\/h3>\n\n\n\n