Ionic - App Susceptible to URI Scheme Hijacking

[shishiraetna]

while having a security inspection of iOS app generated by ionic, I got an critical security bug. According to Data Theorem,

The App defines the capacitor:// URI schemes for receiving messages from other Apps on the device. Any URI scheme defined by the App can be hijacked by another App, if the malicious App registers the same scheme and also gets installed on the device.

Does any one have any clue to resolve this issue?

[jcesarmobile]

Capacitor 3 apps no longer define the capacitor:// URI scheme by default, it's up to the user to create one if they want to launch the app from aun URI scheme, as documented on App plugin docs

If it's a Capacitor 2 app, we don't recommend using capacitor as URI scheme, that was just a default value that users should change, not because of malicious attacks, but because if you created two capacitor apps and both are registered for capacitor scheme you don't know which one will open, URI schemes should be unique.

If you are worried about URI schemes, then you can instead use Universal Links as that uses https urls and require to host a file on a server you own, so nobody else can register that Universal Link