Android: OnBootReceiver: Exported receiver does not require permission

Question

I've created a BroadcastReceiver, which receives BOOT_COMPLETED.

In my AndroidManifest.xml I've added it like so:

<receiver
    android:name=".OnBootReceiver">
    <intent-filter>
        <action android:name="android.intent.action.BOOT_COMPLETED" /> 
        <action android:name="android.intent.action.QUICKBOOT_POWERON" />
    </intent-filter>
</receiver>

However, I get the warning: Exported receiver does not require permission. I've read about it on SO, but I don't fully understand it.

So could someone explain to this beginner :) why I'm getting this warning, and what to do against it (and why)?

Graiggrail

it just means that anyone can call it, as it is public and does not require permission (a receiver can request a specific permission to be called) – Hedvige

@Hedvige but not adding it makes it stop working? I remember i tried one time and it didn't work but my code had some issues so I'm not sure. – Sacha

@Hedvige So actually, I don't have to do anything against it? – Graiggrail

@Merlin : you can safely ignore this warning. – Hedvige

Does this warning get displayed still -after cleaning and rescanning Lint warnings ? I have something similar in my manifest but no warnings - and trying to decide if I should add exported="false" or not. See also here – Jerri

Answer 1

The warning

Exported receiver does not require permission

means, You have an intent-filter with some action (which means by default you have android:exported="true" set and it can now receive broadcasts from ANY broadcasters outside of your application) Since it can receive broadcasts from ANY broadcasters outside of your application, it warns you by saying "Hey, are you sure ANY broadcaster can invoke you? In my opinion, it is better if you allow only those broadcasters to invoke you that has the permission you have set for this receiver through android:permission"

Hope this is clear!!!

Royston

what if it's just part of the API ? like in this example the boot complete? or like when a new camera image was taken (using this: java.labsoft.dcc.ufmg.br/apiminer/static/docs/reference/android/… ) ? – Rattlebrain

Answer 2

You can remove this warning by adding android:exported="false" to the receiver tag (see this answer: https://mcmap.net/q/152186/-quot-exported-activity-does-not-require-permission-quot-when-attempting-to-launch-from-a-uri)

Sportsman

And if you set exported to false, can it still be called when boot completed? – Graiggrail