Android: what's the meaning of exported receiver's attribute?

Question

   <receiver
        android:name="MyReceiver"
        android:enabled="true"
        android:exported="true">
        <intent-filter>
            <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
            <action android:name="android.intent.action.BOOT_COMPLETED" />
        </intent-filter>  
  </receiver>

I don't understand if it's needed to be notified. If it were true any app could call my receiver with those actions? So If I make it false the system can send the actions to my receiver?

Answer 1

I don't understand if it's needed to be notified. If it were true any app could call my receiver with those actions? So If I make it false the system can send the actions to my receiver?

Actually, others apps cannot "call your receiver". Other apps can just send broadcast Intents. The System will then call all registered receivers.

In general you shouldn't worry about this. Most of these broadcast Intents are protected so that only system apps can broadcast them anyway. An attempt by another app to broadcast BOOT_COMPLETED, for example, would just be ignored. What would happen if your BroadcastReceiver gets triggered by a rogue app because it broadcast CONNECTIVITY_CHANGE? Probably nothing, because your app should check the real connectivity state in onReceive() anyway, and if there isn't any change you can just ignore it.

Also, you don't need to specify android:enabled="true" because this is the default state. You also don't need to specify android:exported="true" because you have an <intent-filter> attached to your <receiver> which automatically sets android:exported to true.