Android: what's the meaning of exported receiver's attribute?

Question

   <receiver
        android:name="MyReceiver"
        android:enabled="true"
        android:exported="true">
        <intent-filter>
            <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
            <action android:name="android.intent.action.BOOT_COMPLETED" />
        </intent-filter>  
  </receiver>

I don't understand if it's needed to be notified. If it were true any app could call my receiver with those actions? So If I make it false the system can send the actions to my receiver?

Solution 1

I don't understand if it's needed to be notified. If it were true any app could call my receiver with those actions? So If I make it false the system can send the actions to my receiver?

Actually, others apps cannot "call your receiver". Other apps can just send broadcast Intents. The System will then call all registered receivers.

In general you shouldn't worry about this. Most of these broadcast Intents are protected so that only system apps can broadcast them anyway. An attempt by another app to broadcast BOOT_COMPLETED, for example, would just be ignored. What would happen if your BroadcastReceiver gets triggered by a rogue app because it broadcast CONNECTIVITY_CHANGE? Probably nothing, because your app should check the real connectivity state in onReceive() anyway, and if there isn't any change you can just ignore it.

Also, you don't need to specify android:enabled="true" because this is the default state. You also don't need to specify android:exported="true" because you have an <intent-filter> attached to your <receiver> which automatically sets android:exported to true.

Solution 2

If you set android:exported ="false", implies that the receiver is intended only for application-internal use.

Note: This attribute is not the only way to limit a broadcast receiver's external exposure. You can also use a permission to limit the external entities that can send it messages

Comments

[David Wasser]

This is wrong. If you set android:exported="true", the receiver is public, not application-internal. Since there is an <intent-filter> present in the <receiver> declaration, android:exported="true" is redundant because the default setting is true if there is an <intent-filter> present. If you wanted to limit this receiver to application-only, you would need to explicitly set android:exported="false".

[SaravInfern]

@DavidWasser sorry my mistake , have edited my answer, thanks for noticing

[user905686]

Apparently Android 12 requires to set the android:exported attribute also for receiver.

[VIN]

See here for permissions mentioned in the answer: developer.android.com/training/permissions/…

[JCarlosR]

Just wanted to confirm that the default value for exported is true: developer.android.com/guide/topics/manifest/service-element

[David Wasser]

@JCarlosR The default value for exported is true only if you have <intent-filter> declared. Additionally, if your app targets Android 12 or higher and the component has an <intent-filter> declaration you must explicitly declare exported (there is no default value), see developer.android.com/about/versions/12/…