Expo Client Deep Link Security: Preventing Session Hijacking
I understand the typical sign-in flow when using the Expo Client looks like this:
1. A user visits
2. They are redirected to
3. After successful authentication, they are sent back to
4. The
My concern is that anyone can register the same deep link. For example, if I run
* Am I misunderstanding something about how deep links work?
* Is there a built-in mechanism to ensure only the genuine app can receive the cookie?
* How do you prevent malicious or clone apps from intercepting the Expo Client’s authentication flow?
Thanks in advance for any insights!
1. A user visits
/sign-in2. They are redirected to
accounts.google.com3. After successful authentication, they are sent back to
/callback4. The
/callbackMy concern is that anyone can register the same deep link. For example, if I run
example-service.comexample-service://* Am I misunderstanding something about how deep links work?
* Is there a built-in mechanism to ensure only the genuine app can receive the cookie?
* How do you prevent malicious or clone apps from intercepting the Expo Client’s authentication flow?
Thanks in advance for any insights!
