Deep links and URL schemes: how do you validate input and avoid being attacked?
Essence
Anyone can open a deep link: a web page, a message, a QR code, a push, another app. So any URL that reaches the app is untrusted input, just like a form field. A deep link should only take the user to the right screen and prefill data, while consequential actions — a payment, a deletion, a settings change — are confirmed by the user.
The rest of this answer, with code and interview follow-ups, is in the DevPrep app.
Read the full answer in DevPrep