Deep Link Validation & Security

Relevant source files

The following files were used as context for generating this wiki page:

• DeepLinkHandler.swift
• AppDelegate.swift
• APIClient.swift
• UserService.swift
• KeychainManager.swift

The Deep Link Validation & Security system in Social-Connect provides a centralized mechanism for intercepting, validating, and executing actions triggered by external URLs. The system ensures that incoming URIs are parsed correctly and that sensitive actions—such as following users or accessing profiles—are only performed after valid parameter extraction and security token verification.

The architecture relies on a hand-off from the iOS UIApplicationDelegate to a dedicated handler that interfaces with authenticated services. This ensures that deep link actions are subject to the same security constraints as standard in-app requests, including Bearer token authentication stored in the system keychain.

Deep Link Architecture & Routing

Deep links enter the application through the AppDelegate, which acts as the initial entry point. The application utilizes the application(_:open:options:) method to capture incoming URLs and delegate the processing logic to the DeepLinkHandler.

Routing Logic

The DeepLinkHandler uses the host component of the URL to determine the destination module. It supports several specific routes including user profiles, messaging, posts, and social actions like following.

The flow above illustrates how an external request is routed through the internal validation logic.
Sources: AppDelegate.swift:15-18, DeepLinkHandler.swift:8-28

Supported Deep Link Hosts

Host	Action	Required Parameters
profile	Navigates to a specific user's profile page.	userId
message	Opens the messaging interface.	N/A (Implementation pending)
post	Views a specific post.	N/A (Implementation pending)
follow	Triggers an automated follow request for a user.	userId

Sources: DeepLinkHandler.swift:19-30

Validation & Parameter Extraction

Security is maintained by strict validation of URL components. The DeepLinkHandler utilizes URLComponents to resolve URLs and extract query items safely.

User Identification Validation

For actions like profile and follow, the system requires a userId. The handler specifically looks for a query item named "userId" within the URL parameters. If this parameter is missing, the validation fails, and the deep link is ignored to prevent null-pointer exceptions or undefined behavior in the UI and API layers.

private func handleFollowDeepLink(_ components: URLComponents) -> Bool {
    guard let userId = components.queryItems?.first(where: { $0.name == "userId" })?.value else {
        return false
    }
    
    // Follow the user
    userService.followUser(userId: userId)
    return true
}

Sources: DeepLinkHandler.swift:32-40, DeepLinkHandler.swift:42-49

Security Integration & Authentication

While deep links provide the "what" and "who," the security layer provides the "permission." Actions triggered by deep links, such as followUser, are passed to the UserService, which interacts with the APIClient.

Keychain-Backed Authentication

Every network request generated by a deep link action is automatically secured. The APIClient retrieves a "Bearer" token from the KeychainManager to populate the Authorization header. This ensures that even if a deep link is spoofed, the underlying API request will fail if the user is not locally authenticated.

The sequence diagram demonstrates the multi-layered security check applied to deep link actions.
Sources: APIClient.swift:18-21, KeychainManager.swift:11-23, UserService.swift:10-14

Request Security Summary

• Token Retrieval: Uses SecItemCopyMatching with kSecClassGenericPassword to ensure hardware-level security for the authToken.
• Authorization Header: Injects Bearer \(token) into the URLRequest.
• Validation: The APIClient checks for HTTP status codes in the 200...299 range to confirm the action was authorized and successful.

Sources: KeychainManager.swift:11-18, APIClient.swift:19-36

Summary of Components

Component	Responsibility	Source File
AppDelegate	Entry point for system URL events.	AppDelegate.swift
DeepLinkHandler	Logic for host switching and parameter validation.	DeepLinkHandler.swift
UserService	Logic for social actions (follow/unfollow).	UserService.swift
APIClient	Handles HTTP requests and Auth header injection.	APIClient.swift
KeychainManager	Secure storage and retrieval of credentials.	KeychainManager.swift

The Deep Link Validation & Security module effectively bridges the gap between external intents and internal secure operations. By enforcing strict parameter checking in the DeepLinkHandler and relying on the KeychainManager for credential injection in the APIClient, the application prevents unauthorized or malformed external requests from compromising user data or performing unintended social actions.