androidoauthuri-scheme

What happens if two android apps register the same custom URI schema?

I'm no Android-Developer but I need to know what happens, if two applications register the same URI schema (e.g. by using an intent-filter). Is that possible at all?

In iOS it is. Multiple apps can register for the same URI schema. It can not be predicted which app will be launched when that schema is called. To make things worse, the app that is launched "consumes the event". So no other app will be noticing anything.

Background of my question: I'm working on a "secure" concept for the implicit flow in OAuth 2.0. This flow includes a redirect (comming from the server) to a URI schema. Unfortunately, I can't use a WebView in the app, because the app mustn't have any possibility to gain access to the users credentials.

Solution

  • Is that possible at all?

    Yes, at least for activities. When something tries to start an activity matching the scheme (and rest of the <intent-filter>, the user will get a "chooser" window, showing all possible activities, from which the user can choose.