58

So for my new app I'm having a URL scheme so that people can launch my app from another app or from a website... "myapp://" ... So what happens if there is another app in the AppStore that has the same URL scheme as mine? Or if someone tries to steal my URL Scheme?

Albert Renshaw
  • 17,282
  • 18
  • 107
  • 195

4 Answers4

47

If two apps register the same custom URL scheme, it is undefined which app will actually be launched. One will be launched but there is no way to know.

Here's a real kicker. If you have two apps on your device with the same URL scheme, and you delete the one that actually gets launched, the other one will not get launched by the URL without rebooting the iOS device.

Your best solution is to ensure your custom URL scheme is not trivial so there is little chance another app will have the same scheme.

Albert Renshaw
  • 17,282
  • 18
  • 107
  • 195
rmaddy
  • 314,917
  • 42
  • 532
  • 579
  • 7
    But what about malicious developers can you prevent against that? For example what if I made my URL scheme "Facebook://" or whatever they use... perhaps every time someone clicks like my app gets launched and a user sees an ad or two and I get money :o (I wouldn't do this of course but there are some pathetic people out there that might) ehhh – Albert Renshaw Oct 29 '12 at 22:26
  • I've never heard of anyone doing that but you are right, someone could. I suppose it's possible Apple checks to make sure any custom URL schemes you define appear appropriate for your app but I've never heard of anyone having to change their scheme before. – rmaddy Oct 29 '12 at 22:31
  • 22
    Apple should let developers create URL schemes online and tell there upfront if something is already taken. – Amogh Talpallikar May 09 '13 at 12:17
  • 6
    I had same doubts and stumbled upon this thread. @AmoghTalpallikar - If Apple provides a URL registering framework, people would simply register lots of URL schemes and they go unused. Maybe there should have been a way where URL schemes are somehow linked with the provisioning profile of the app, or, the way Push notifications work which is linked with the developer's / Ad-hoc provisioning profile etc. Still, whatever system currently is setup, clearly its not secure as rightly pointed out by the questioner of this post. – Raj Pawan Gumdal May 22 '13 at 06:15
  • @Raj: but in case one wanted a clean URL scheme which is easier to remember and looks standard instead of a weird long string. like Google Chrome uses googlechrome:// for chrome in iOS and they use it smartly in other Google apps if they wanted the links to open in Chrome instead of Safari. – Amogh Talpallikar May 27 '13 at 05:27
  • 6
    Note that the bug around deleting an app handling a URL is fixed as of (at least) iOS8 – Rog Jun 18 '15 at 08:29
  • Question: what if you have 2 app targets that share a url scheme? In production, a user would never have both installed, but testers might. Apple will not block this, correct? – Lytic Apr 13 '17 at 02:25
  • @Lytic I have an app group that all share a common URL scheme. Apple hasn't ever had a problem with that. – rmaddy Apr 13 '17 at 02:55
  • Thanks! Did you ever find a way to support simultaneous installs? – Lytic Apr 15 '17 at 18:51
16

According to the Apple docs:

If multiple third-party applications register to handle the same URL scheme, it is undefined as to which of the applications is picked to handle URLs of that type.

Exact quote from the Apple docs, for 8 consecutive years:

Note: If more than one third-party app registers to handle the same URL scheme, there is currently no process for determining which app will be given that scheme.

Sources:

As of September 2019, this part of the documentation was removed from the Apple website. The closest related document may now be Register Your URL Scheme.

Cœur
  • 37,241
  • 25
  • 195
  • 267
Dustin
  • 189
  • 5
4

Updated for 2016

Apple's policy has changed since 2012. Today they indicate that multiple apps will not be allowed to register for the same scheme. Registration time is a much cleaner place to address contention than runtime, since it avoids the security issues discussed it other answers.

Note: If more than one third-party app registers to handle the same URL scheme, there is currently no process for determining which app will be given that scheme.

Source:https://developer.apple.com/library/ios/documentation/iPhone/Conceptual/iPhoneOSProgrammingGuide/Inter-AppCommunication/Inter-AppCommunication.html#//apple_ref/doc/uid/TP40007072-CH6-SW1

Bosh
  • 8,138
  • 11
  • 51
  • 77
  • 11
    I'm confused. It seems you're saying that more than one app can't have the same URL scheme but then you add the "note" saying that they can and it's undefined, which is what the 2012 answer said. – Albert Renshaw Feb 28 '16 at 11:50
  • 1
    Let me try to clarify: in 2012, Apple would allow multiple apps to register with the same scheme, and the runtime behavior of which one will be launched was undefined. Now, Apple appears to be making the decision at registration time instead of runtime, which means that behavior at runtime will be well defined, with only one possible app for a given scheme. – Bosh Mar 01 '16 at 05:00
  • 5
    @Bosh I don't see how your comment clarifies your answer. What do you mean by "registration time"? So far I see nothing in your answer that is any different than it was in 2012. – rmaddy Mar 01 '16 at 16:56
  • The language on Apple's page changed -- that's clear at least, right? The difference is that previously two apps could register with the same custom scheme, and would "fight it out" when an actual redirect occurred on a user's device (that's what I mean by "runtime"). Now, Apple is saying they won't allow two apps to register the same custom scheme (that's what I mean by "registration time"). – Bosh Mar 10 '16 at 23:30
  • 1
    @Bosh I would like to clarify a bit register. So there are two possible ways as far as I see. 1. Apple will reject the app if they see that you trying to submit an app with a URL that already is obtained by another app. 2. Apple will totally allow to upload apps to the AppStore with the same URL scheme but when you download an app that has a URL that is already supported by another app on you phone it will simple ignore your app as supported app for that URL? – Bagrat Kirakosian Jun 11 '16 at 23:01
  • 1
    @Bosh "that multiple apps will not be allowed to register for the same scheme". Do you have a source for this? In the link you provided they only say something about the order in which they allow custom url schemes. Not about whether they allow multiple apps with the same scheme – Vincent Dec 27 '16 at 12:23
  • 1
    @Bosh I think you are misinterpreting the documentation. "If more than one third-party app registers to handle the same URL scheme" --> this means 2 apps can register the same scheme, meaning your answer is wrong – Vincent Dec 27 '16 at 12:57
  • 1
    @Albert Renshaw What do you think of the 2 above comments? – Vincent Dec 30 '16 at 06:55
  • 4
    @Vincent I think you're right, it seems the documentation now says what it originally said in 2012 (not sure if it ever changed) it appears two apps can still have conflict issues in URL schemes. I googled the italicized quote in Bosh's answer and found no URLs with those words except this post and an archiving site of this post. – Albert Renshaw Dec 30 '16 at 20:56
  • 1
    I'm accepting the answer by @rmaddy until Bosh can provide some clarification – Albert Renshaw Dec 30 '16 at 20:59
  • 1
    It would be the best if every apple app always use store id or bundleid as default url scheme without doing anything. Then it would be easy to just do deep linking for the OS – Thaina Yu May 26 '18 at 08:45
  • @Thaina I agree, that wound make much more sense, than to allow app developers to name the url-scheme as they please. I think Apple doesn't really care about the issues with URL-Schemes because they've been pushing apps to use Universal Links for quite awhile now. – thedp Jul 01 '20 at 12:56
2

As covered by the other answers in this thread, it is perfectly acceptable for multiple apps to be registered as capable of handling a particular custom URL scheme. If there are 2+ apps installed on the device which are registered as capable of handling a particular custom URL scheme, it is undefined as to which app will be selected by the system at runtime.

If it is important for your particular use case that your app and only your app is registered on the device as capable of handling a particular URL, then prefer universal links over custom URL schemes. Universal links are standard HTTP or HTTPS links. The rough idea of universal links is that, on installation of your app, the system checks a file stored on your web server to verify that your website allows your app to open URLs on its behalf. If your app is not installed on the device when such a URL is opened, the system opens the URL in Safari as normal, allowing your website to handle it.

For further information on both universal links and custom URL schemes, refer to the Allowing Apps and Websites to Link to Your Content documentation page.

Adil Hussain
  • 30,049
  • 21
  • 112
  • 147
  • From current Apple docs, upon saying that the URL scheme is also backed by an app identifier string: "The identifier you supply with your scheme distinguishes your app from others that declare support for the same scheme. To ensure uniqueness, specify a reverse DNS string that incorporates your company’s domain and app name. Although using a reverse DNS string is a best practice, it doesn’t prevent other apps from registering the same scheme and handling the associated links. Use universal links instead of custom URL schemes to define links that are uniquely associated with your website." – Sorin Dolha Oct 07 '20 at 12:13
  • @SorinDolha, it's not clear from that quote which you shared and the documentation page in general (i.e. [this](https://developer.apple.com/documentation/xcode/allowing_apps_and_websites_to_link_to_your_content/defining_a_custom_url_scheme_for_your_app) page) how the system uses the identifier to distinguish multiple apps that declare support for the same scheme. If you can provide an explanation, that would be great. – Adil Hussain Oct 08 '20 at 07:19
  • 1
    Yeah, sorry for that - there were just not enough characters left in the comment to include the link. Here it is: https://developer.apple.com/documentation/xcode/allowing_apps_and_websites_to_link_to_your_content/defining_a_custom_url_scheme_for_your_app#2928963. But unfortunately I don't find anything about how the system uses the identifier to decide which app to start or if it does use it for anything. In a few other threads on this topic, however, some suggest - saying they reached the conclusion by experiment - that the first installed app that uses that same scheme will be called. – Sorin Dolha Oct 08 '20 at 07:24