Universal Links support the relationship between an application and a web domain. The authority of a transaction request carried by the link still needs independent verification.
Evaluation approach
Review URL parameters, session state and the destination screen's permission requirements alongside the domain association.
Application example
When a payment link opens, show its recipient and amount. A link opened under another account must not inherit previous authority.
Limits and considerations
Opening in the correct application does not mean the transaction data has been authorized.
Link routing is not authorization
Universal Links use the relationship between a web domain and an application to route navigation. A link opening the application does not establish access rights to the referenced object. Maintain input validation and server authorization.
Check account changes, unauthenticated openings and repeated taps. A pending operation must not apply to the wrong user. Matching the server-side association with application configuration also belongs in release validation.
Checks and decisions
- Verify the association file
- Test account switching
- Check parameters on the server
Demonstrate consistent account and object checks across every entry path.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.