Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Is android:exported="true" really necessary for an authentication service?

Tags:

There are usually two services involved with implementing an Android authenticator - the Authentication service to return an authenticator, and the Sync service which provides a sync adapter. This question is specifically about the Authentication service, although in most examples both services are given the android:exported="true" attribute in the AndroidManifest.xml, eg:

<service     android:name=".authenticator.AuthenticationService"     android:exported="true">     <intent-filter>         <action             android:name="android.accounts.AccountAuthenticator" />     </intent-filter>     <meta-data         android:name="android.accounts.AccountAuthenticator"         android:resource="@xml/authenticator" /> </service> 

Removing the attribute from the Authentication service seems to have no effect (tested Froyo, Gingerbread) - the auth code continues to work just fine - so is the flag actually necessary?

like image 294
Roberto Tyley Avatar asked Feb 14 '12 09:02

Roberto Tyley


People also ask

What is the use of Android exported true?

The exported attribute is used to define if an activity, service, or receiver in your app is accessible and can be launched from an external application.

What is exported false in Android?

Android Manifest's android:exported="false" prevents app from running on device.

How do I declare a service in manifest Android?

You declare a service in your app's Manifest, by adding a <service> element as a child of your <application> element. There's a list of attributes that you can use to control a service's behavior, but as a minimum you'll need to provide the service's name (android:name) and a description (android:description).

What is Android enabled true?

The default value is " true ". The <application> element has its own enabled attribute that applies to all application components, including broadcast receivers. The <application> and <receiver> attributes must both be " true " for the broadcast receiver to be enabled.


1 Answers

Ok, to answer this myself by reading the docs, the documentation for the exported attribute says:

The default value depends on whether the service contains intent filters. The absence of any filters means that it can be invoked only by specifying its exact class name. This implies that the service is intended only for application-internal use (since others would not know the class name). So in this case, the default value is "false". On the other hand, the presence of at least one filter implies that the service is intended for external use, so the default value is "true".

All Authentication services have an intent filter - the docs for AbstractAccountAuthenticator say:

In order to be an authenticator one must ... write a service that returns the result of getIBinder() in the service's onBind(android.content.Intent) when invoked with an intent with action ACTION_AUTHENTICATOR_INTENT.

This requires an intent filter, consequently the default value of exported for the service is true. So the answer to this question is "No, the attribute is not necessary - because it's true by default".

like image 188
Roberto Tyley Avatar answered Sep 24 '22 07:09

Roberto Tyley