Android redirect from browser to app

Redirect URLs for Native Apps

Native applications are clients installed on a device, such as a desktop application or native mobile application. There are a few things to keep in mind when supporting native apps related to security and user experience.

The authorization endpoint normally redirects the user back to the client’s registered redirect URL. Depending on the platform, native apps can either claim a URL pattern, or register a custom URL scheme that will launch the application. For example, an iOS application may register a custom protocol such as myapp:// and then use a redirect_uri of myapp://callback .

App-Claimed https URL Redirection

Some platforms, (Android, and iOS as of iOS 9), allow the app to override specific URL patterns to launch the native application instead of a web browser. For example, an application could register https://app.example.com/auth and whenever the web browser attempts to redirect to that URL, the operating system launches the native app instead.

If the operating system does support claiming URLs, this method should be used. This allows the identity of the native application to be guaranteed by the operating system. If the operating system does not support this, then the app will have to use a custom URL scheme instead.

Custom URL Scheme

Most mobile and desktop operating systems allow apps to register a custom URL scheme that will launch the app when a URL with that scheme is visited from the system browser.

Using this method, the native app starts the OAuth flow as normal, by launching the system browser with the standard authorization code parameters. The only difference is that the redirect URL will be a URL with the app’s custom scheme.

When the authorization server sends the Location header intending to redirect the user to myapp://callback#token=. , the phone will launch the application and the app will be able to resume the authorization process, parsing the access token from the URL and storing it internally.

Custom URL Scheme Namespaces

Since there is no centralized method of registering URL schemes, apps have to do their best to choose URL schemes that won’t conflict with each other.

Your service can help by requiring the URL scheme to follow a certain pattern, and only allow the developer to register a custom scheme that matches that pattern.

For example, Facebook generates a URL scheme for every app based on the app’s client ID. For example, fb00000000:// where the numbers correspond to the app’s client ID. This provides a reasonably sure method of generating globally unique URL schemes, since other apps are unlikely to use a URL scheme with this pattern.

Another option for apps is to use the reverse domain name pattern with a domain that is under the control of the app’s publisher. This is also something that can be enforced by the service.

Want to implement OAuth 2.0 without the hassle?

We’ve built API access management as a service that is secure, scalable, and always on, so you can ship a more secure product, faster.

Источник

How to Open an Android App from the Browser

Alex Austin

January 8th, 2018

Opening an installed app from a browser is often referred to as “deep linking”, and with this guide you’ll learn how to deep link into your Android app for yourself. We’ll focus exclusively on how to trigger an app open from a website page, rather than from the click of a link inside other apps. For a more detailed look at all of the different deep linking standards required for complete Android coverage, please see our Android deep linking series: Part 1 , Part 2 , Part 3 , and Part 4 .

Android is, by far, one of the most fragmented platforms that developers have ever had to manage, due to Google’s decision to force device manufacturers to be responsible for porting the OS, which requires backwards compatibility and support of a multitude of devices. In this ecosystem, we, the app developers, are left to pick up the pieces. Deep linking on Android is unfortunately no different—over the years, we’ve seen a plethora of technical requirements that must be used depending on the circumstance and context of the user.

Note that Branch will implement all of this complexity for you, host the deep links, and even give you robust analytics behind clicks, app opens, and down funnel events. You can play around with Branch links for free by signing up here . We highly recommend using our tools instead of trying to rebuild them from scratch, since we give them all away for free.

Overview of Changes

There are two places where changes will need to be made in order to successfully open your Android app: your website and your Android app. You can find the details of each change in the corresponding sections below.

Adding Support for URI Schemes to Your App

A URI scheme can be any string without special characters, such as http , pinterest , fb or myapp . Once registered, if you append :// to the end (e.g. pinterest://) and click this link, the Pinterest app will open up. If the Pinterest app is not installed, you’ll see a ‘Page Not Found’ error.

It is simple to configure your app for a URI scheme. To start, you need to pick an Activity within your app that you’d like to open when the URI scheme is triggered, and register an intent filter for it. Add the following code within the tag within your manifest that corresponds to the Activity you want to open.

You can change your_uri_scheme to the URI scheme that you’d like. Ideally, you want this to be unique. If it overlaps with another app’s URI scheme, the user will see an Android chooser when clicking on the link. You see this often when you have multiple browsers installed, as they all register for the http URI.

Next, you’ll want to confirm that your app was opened from the URI scheme. To handle the deep link in the app, you simply need to grab the intent data string in the Activity that was opened via the click. Below is an example:

From here, you’ll need to do string parsing to read the values appended the URI scheme that will be very specific to your use case and implementation.

Adding Javascript to Your Website to Open Your App

Now that your Android app is ready to be triggered from a URI scheme, the next part is simple. You merely need to add some Javascript to your website that will auto trigger your app open. The function below, triggerAppOpen , will attempt to open your app’s URI scheme once you replace your_uri_scheme with the one you added in the manifest above.

You could call triggerAppOpen into window.onload if you wanted to do it on page load, or you could make it the onclick of a link somewhere on your site. Either works and the you’ll get the intended results.

Android is incredibly complicated, and there are edge cases everywhere. You’ll think everything is going well until you get that one user complaining that his links aren’t working on Facebook while running Android 4.4.4. That’s why you should use a tool like Branch—to save you this nightmare and ensure that your links work everywhere. Be sure to request a Branch demo if you’re interested in learning more.

Источник

Android Intents with Chrome

Published on Friday, February 28, 2014

A little known feature in Android lets you launch apps directly from a web page via an Android Intent. One scenario is launching an app when the user lands on a page, which you can achieve by embedding an iframe in the page with a custom URI-scheme set as the src , as follows: . This works in the Chrome for Android browser, version 18 and earlier. It also works in the Android browser, of course.

Читайте также:  Чтение epub для андроид

The functionality has changed slightly in Chrome for Android, versions 25 and later. It is no longer possible to launch an Android app by setting an iframe’s src attribute. For example, navigating an iframe to a URI with a custom scheme such as paulsawesomeapp:// will not work even if the user has the appropriate app installed. Instead, you should implement a user gesture to launch the app via a custom scheme, or use the «intent:» syntax described in this article.

# Syntax

The best practice is to construct an intent anchor and embed that into the page so the user can launch the app. This gives you a lot more flexibility in controlling how apps are launched, including the ability to pass extra information into the app via Intent Extras.

The basic syntax for an intent-based URI is as follows:

See the Android source for parsing details.

Also, you may choose to specify fallback URL by adding the following string extra:

When an intent could not be resolved, or an external application could not be launched, then the user will be redirected to the fallback URL if it was given.

Some example cases where Chrome does not launch an external application are as follows:

• The intent could not be resolved, i.e., no app can handle the intent.
• JavaScript timer tried to open an application without user gesture.

Note that S. is a way to define string extras. S.browser_fallback_url was chosen for backward compatibility, but the target app won’t see browser_fallback_url value as Chrome removes it.

# Examples

Here’s an intent that launches the Zxing barcode scanner app. It follows the syntax thus:

To launch the Zxing barcode scanner app, you encode your href on the anchor as follows:

See the Android Zxing Manifest, which defines the package and the host.

Also, if fallback URL is specified, the full URL will look like this:

Now the URL will get you to zxing.org if the app could not be found, or the link was triggered from JavaScript without user gesture (or for other cases where we don’t launch an external application.)

# Considerations

If the activity you invoke via an intent contains extras, you can include these as well.

Only activities that have the category filter, android.intent.category.BROWSABLE are able to be invoked using this method as it indicates that the application is safe to open from the Browser.

# See also

And Chrome doesn’t launch an external app for a given Intent URI in the following cases.

• When the Intent URI is redirected from a typed in URL.
• When the Intent URI is initiated without user gesture.

Last updated: Friday, February 28, 2014 • Improve article

Источник