Android: OnBootReceiver: Exported receiver does not require permission

Question

I've created a BroadcastReceiver, which receives BOOT_COMPLETED.

In my AndroidManifest.xml I've added it like so:

<receiver
    android:name=".OnBootReceiver">
    <intent-filter>
        <action android:name="android.intent.action.BOOT_COMPLETED" /> 
        <action android:name="android.intent.action.QUICKBOOT_POWERON" />
    </intent-filter>
</receiver>

However, I get the warning: Exported receiver does not require permission. I've read about it on SO, but I don't fully understand it.

So could someone explain to this beginner :) why I'm getting this warning, and what to do against it (and why)?

Answer 1

The warning

Exported receiver does not require permission

means, You have an intent-filter with some action (which means by default you have android:exported="true" set and it can now receive broadcasts from ANY broadcasters outside of your application) Since it can receive broadcasts from ANY broadcasters outside of your application, it warns you by saying "Hey, are you sure ANY broadcaster can invoke you? In my opinion, it is better if you allow only those broadcasters to invoke you that has the permission you have set for this receiver through android:permission"

Hope this is clear!!!

Answer 2

You can remove this warning by adding android:exported="false" to the receiver tag (see this answer: https://stackoverflow.com/a/11526028/757073)