Validate Android Deep Links and App Links Before Release

Separate association from authorization

Domain verification establishes a relationship between a domain and application identity under the platform's rules. Your app still needs to validate the route, parameters and user access before showing or modifying protected data.

The App Links verification guide explains the domain association and testing workflow. Use the certificate fingerprint for the actual distributed signing identity, not automatically the upload key or a local debug certificate.

Validate parsed values

Avoid substring host checks and do not execute an arbitrary action named by a query parameter. Decode and parse carefully so alternate encodings do not bypass the intended route rules.

Inspect the exported handler

Link-handling activities are often intentionally exported. Follow the exported-component guidance and protect sensitive operations after entry. An activity being reachable is not itself proof of a vulnerability; the question is what untrusted callers can cause it to do.

Test a route matrix

Test valid public links, protected links while logged out, cross-account object IDs, malformed parameters, unknown hosts and canceled authentication. Include the actual release certificate and the relevant domain-association files in the test record.

A browser opening the app once does not prove every host and route is verified correctly.

Use APKLint for the declaration review

The Exported Activity Checker can help inspect intent filters and exposure. It cannot verify your domain's live association file or enforce backend authorization. Combine static review with current platform verification tests and application-level route tests before publishing a release.