iOS URL Scheme Hijacking
Overview
Custom URL schemes (e.g., myapp://) can be registered by any app on the device. A malicious app registering the same scheme can intercept deep links, OAuth callbacks, and payment confirmations.
Remediation
- Use Universal Links (HTTPS-based) instead of custom URL schemes for sensitive flows
- Validate the
sourceApplicationparameter in URL handler - Never pass sensitive tokens via URL scheme parameters
- For OAuth, use ASWebAuthenticationSession with system-managed callback