Prevent iOS URL scheme hijack

Question

I have an app that gets opened from another app via a URL scheme. The URL contains signup tokens. As any app can register the same URL scheme as my app, I am concerned a "fake" app can do a man-in-the-middle attack and capture the signup tokens.

My idea is to check that the URL scheme does not open another app when my app is first opened.

From a security perspective, if the URL scheme opens my app the first time, will it always open my app in the future?

Answer 1

How about using iOS 9 universal links?

Unlike custom URL schemes, universal links can’t be claimed by other apps, because they use standard HTTP or HTTPS links to your website.

https://developer.apple.com/library/prerelease/ios/documentation/General/Conceptual/AppSearch/UniversalLinks.html

This way the "dispatch table" is on your server, so no other app can hijack the signup URL. (URL dispatch is based on AppIDs)