iOS URL Scheme Hijacking

Detects iOS custom URL scheme handling that processes sensitive data without sender verification.

zakirkun Updated

File contents

iOS URL Scheme Hijacking

Overview

Custom URL schemes (e.g., myapp://) can be registered by any app on the device. A malicious app registering the same scheme can intercept deep links, OAuth callbacks, and payment confirmations.

Remediation

  • Use Universal Links (HTTPS-based) instead of custom URL schemes for sensitive flows
  • Validate the sourceApplication parameter in URL handler
  • Never pass sensitive tokens via URL scheme parameters
  • For OAuth, use ASWebAuthenticationSession with system-managed callback

zakirkun/ice-tea/tree/main/skills/mobile/ios/url-scheme-hijacking commit 497a9351fb

Frequently asked questions

npx skillmds@latest add zakirkun/ios-url-scheme-hijacking