Android: what's the meaning of exported receiver's attribute?

Question

   <receiver
        android:name="MyReceiver"
        android:enabled="true"
        android:exported="true">
        <intent-filter>
            <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
            <action android:name="android.intent.action.BOOT_COMPLETED" />
        </intent-filter>  
  </receiver>

I don't understand if it's needed to be notified. If it were true any app could call my receiver with those actions? So If I make it false the system can send the actions to my receiver?

Bernhard

Just read the official documentation – Hornswoggle

for example: "Whether or not the broadcast receiver can receive messages from sources outside its application".... what does it mean outside? Does it involves the system too? – Bernhard

Related post - What is the use of android:exported=“true” in BroadcastReceiver – Fillmore

Answer 1

I don't understand if it's needed to be notified. If it were true any app could call my receiver with those actions? So If I make it false the system can send the actions to my receiver?

Actually, others apps cannot "call your receiver". Other apps can just send broadcast Intents. The System will then call all registered receivers.

In general you shouldn't worry about this. Most of these broadcast Intents are protected so that only system apps can broadcast them anyway. An attempt by another app to broadcast BOOT_COMPLETED, for example, would just be ignored. What would happen if your BroadcastReceiver gets triggered by a rogue app because it broadcast CONNECTIVITY_CHANGE? Probably nothing, because your app should check the real connectivity state in onReceive() anyway, and if there isn't any change you can just ignore it.

Also, you don't need to specify android:enabled="true" because this is the default state. You also don't need to specify android:exported="true" because you have an <intent-filter> attached to your <receiver> which automatically sets android:exported to true.

Mccray

Apparently Android 12 requires to set the android:exported attribute also for receiver. – Indiscrimination

Just wanted to confirm that the default value for exported is true: developer.android.com/guide/topics/manifest/service-element – Summon

@Summon The default value for exported is true only if you have <intent-filter> declared. Additionally, if your app targets Android 12 or higher and the component has an <intent-filter> declaration you must explicitly declare exported (there is no default value), see developer.android.com/about/versions/12/… – Mccray

Answer 2

If you set android:exported ="false", implies that the receiver is intended only for application-internal use.

Note: This attribute is not the only way to limit a broadcast receiver's external exposure. You can also use a permission to limit the external entities that can send it messages

Zia

This is wrong. If you set android:exported="true", the receiver is public, not application-internal. Since there is an <intent-filter> present in the <receiver> declaration, android:exported="true" is redundant because the default setting is true if there is an <intent-filter> present. If you wanted to limit this receiver to application-only, you would need to explicitly set android:exported="false". – Mccray

@DavidWasser sorry my mistake , have edited my answer, thanks for noticing – Zia

See here for permissions mentioned in the answer: developer.android.com/training/permissions/… – Geanticlinal

Answer 3

Actual for Android 13. From official documentation:

Whether the broadcast receiver can receive messages from non-system sources outside its application. It's "true" if it can, and "false" if not. If "false", the only messages the broadcast receiver receives are those sent by the system, components of the same application, or applications with the same user ID. If unspecified, the default value depends on whether the broadcast receiver contains intent filters. If the receiver contains at least one intent filter, then the default value is "true". Otherwise, the default value is "false".

So if you receive intents from other apps (not from system) you should set it to true, otherwise false. You can check if intent is system in this list for API 31. For other API's you need to find the file broadcast_actions.txt inside platforms/android-${VERSION}/data path (replace ${VERSION} with target sdk version).

Analysis

Answer 4

Adding to @SaravInfern's answer. Here is the relevant permission doc for limiting external entities that can send the receiver messages:

https://developer.android.com/training/permissions/restrict-interactions#broadcast-receivers

Geanticlinal