App link host claim
Android App Links and Apple universal links are a host claim: assetlinks.json and apple-app-site-association say which app may open which paths. The gadget is a claim that is broader than the product, served from a host you can influence, or skipped because…
Tags: mobile, applink, deeplink, universal-links
Typical severity: P3-P5
What it becomes
Low alone when the link only opens the app, and it becomes token theft when a claimed host or an unverified scheme carries an auth callback.
Where to look
/.well-known/assetlinks.jsonapple-app-site-associationassociated domains and intent filters in a build you are allowed to inspect
Chains
- Auth callback on the wrong host: The association file or path prefix includes a host you can serve, and the app treats that host as a trusted auth callback.
- Unverified scheme fallback: The https claim is checked, but the same callback is registered as a custom scheme that any installed app can claim.
Notes
- Read the association files and the app's declared hosts. Do not ship a rogue app to a store, and stay inside the mobile surface the program allows.
- A public association file is normal. The finding is a claim that lets an untrusted host or scheme receive a code or a sign-in link.