Secure Deep Linking

In this lesson, you will learn how to treat incoming deep links as untrusted input to prevent malicious actors from manipulating your app's internal navigation.

Why Deep Links Are Risky

A deep link is a URL (like myapp://profile/123) that allows external sources—like a website or a text message—to open your app and trigger a specific screen. However, if your app blindly trusts the data inside these links, a bad actor could craft a URL that forces your app to navigate to a sensitive screen, reset a password, or perform an action that the user didn't authorize.

The Rule: Never Trust, Always Sanitize

When your app receives a deep link, the parameters (like id or target) should be treated exactly like raw user input from a text field. You must validate the format and sanitize the content before passing it to your navigation logic.

Imagine your deep link is myapp://navigate?to=settings. If you blindly pass the to parameter into your router, an attacker might change it to something private. Instead, use an allow-list approach:

const handleDeepLink = (url) => {
  const parsedUrl = new URL(url);
  const targetScreen = parsedUrl.searchParams.get('to');

  // Define allowed routes explicitly
  const allowedRoutes = ['home', 'profile', 'orders'];

  if (allowedRoutes.includes(targetScreen)) {
    navigation.navigate(targetScreen);
  } else {
    // Fallback to a safe screen if the input is unexpected
    navigation.navigate('home');
  }
};

Implementation Best Practices

1. Strict Validation: Use regex or a schema validator to ensure IDs are numeric or formatted correctly. If you expect a numeric userId, reject the request if the input contains letters or special characters.
2. Contextual Awareness: Before navigating based on a deep link, check if the user is authenticated. Never allow a deep link to bypass an authentication wall.
3. Default to Safety: If the link is malformed or directs the user to a path that doesn't exist, always redirect them to a safe "Home" screen rather than throwing an error or crashing.

Key Takeaway: Treat deep links as untrusted external input by validating parameters against an allow-list before initiating navigation.