A verified App Links relationship does not make every incoming parameter trustworthy. A link requests navigation; the server determines authority for sensitive operations.
Evaluation approach
Verified application links help establish a domain relationship. The application and server must still check parameter type, scope and user authorization.
Application example
On a payment-request screen opened from a link, show the recipient and amount. Do not treat URL-supplied values as an already authorized transaction.
Limits and considerations
Domain verification does not make malicious parameters safe.
A link is an input channel
Treat transaction identifiers, URLs and campaign fields in deep links as user-controlled input. Opening the application does not establish that content came from an authorized source or that the user may perform the operation.
Apply normal session checks and server authorization even when a sensitive function begins through a link. After sign-in, test that a pending link is not applied to the wrong account. For flows that accept a destination URL, define permitted purposes and domains explicitly.
Checks and decisions
- Validate parameters
- Test session transitions
- Authorize operations on the server
Check the expected host and path, and verify object ownership separately.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.