ASOS Jack Webb Sep 6, 2023

A Rundown of Android Intent Selectors: Building Intents Correctly

M4 Related OWASP risk: Insufficient Input/Output Validation Learn more →

Article Summary

Jack Webb from ASOS discovered a common Android Intent mistake that could trap users in infinite loops. Most developers use ACTION_VIEW to open URLs, but there's a critical flaw hiding in plain sight.

When building a fallback to open ASOS's website in a browser, Webb hit a bizarre bug: the intent kept opening the ASOS app instead, creating an endless loop. The culprit? ACTION_VIEW is too generic and doesn't distinguish between browsers and apps with deep links. The solution involves a lesser-known Android feature: Intent Selectors.

Key Takeaways

Critical Insight

Using Intent Selectors with CATEGORY_BROWSABLE and an empty http: scheme ensures links always open in actual browsers, not apps with deep link handlers.

The article reveals how this same selector technique applies beyond browsers to phone dialers, VOIP apps, and share targets.

About This Article

Problem

Jack Webb's team at ASOS found an infinite loop bug when users on Android 5 tried to open www.asos.com in external browsers. The issue happened because ACTION_VIEW would pick any app that could handle HTTP URIs, not just actual browsers.

Solution

Webb fixed it by creating two intents. The first was an empty browser intent with CATEGORY_BROWSABLE and an http scheme to filter for real browsers only. He then set this as the selector property on the second intent, which contained the actual destination URL.

Impact

The fix stopped the endless loop. Users could now open the ASOS mobile website in their preferred external browser without the app catching the intent through its registered deep links.