CSRF on inter-app communication iOS

Question

How can I make a request from one app to another on iOS and verify the origin of the app request?

Apple used to have an applicationSource sent along with deeplinks, but it's now being deprecated. Does anyone have any techniques to mitigate against this CSRF?

Answer 1

You should not allow for state to be changed in a meaningful/dangerous way using either URL schemes or deeplinks. Apple gives the following warning:

Warning

URL schemes offer a potential attack vector into your app, so make sure to validate all URL parameters and discard any malformed URLs. In addition, limit the available actions to those that do not risk the user’s data. For example, do not allow other apps to directly delete content or access sensitive information about the user. When testing your URL-handling code, make sure your test cases include improperly formatted URLs.

https://developer.apple.com/documentation/uikit/inter-process_communication/allowing_apps_and_websites_to_link_to_your_content/defining_a_custom_url_scheme_for_your_app

While this is aimed at URL schemes, Apple still does not guarantee the authenticity of any incoming URL based launches (as shown by the deprecation of the source attribute). If you need to communicate securely between processes, you should use an App Group entitlement to direct the system to create a secure, shared sandboxed environment for a specific set of applications your developer team has created. If you need to communicate something between processes, you can write a message file and then launch the other application by its URL scheme and direct it to try and parse the stored message. This is secure as no false messages can be injected without compromising the iOS sandbox.

Answer 2

So after some experimenting it seems that you can set UIApplicationOpenURLOptionsSourceApplicationKey to any value, but Apple overrides it in the receiving app to the correct value allowing you to verify the recipient.