Android: OnBootReceiver: Exported receiver does not require permission

Question

I've created a BroadcastReceiver, which receives BOOT_COMPLETED.

In my AndroidManifest.xml I've added it like so:

<receiver
    android:name=".OnBootReceiver">
    <intent-filter>
        <action android:name="android.intent.action.BOOT_COMPLETED" /> 
        <action android:name="android.intent.action.QUICKBOOT_POWERON" />
    </intent-filter>
</receiver>

However, I get the warning: Exported receiver does not require permission. I've read about it on SO, but I don't fully understand it.

So could someone explain to this beginner :) why I'm getting this warning, and what to do against it (and why)?

it just means that anyone can call it, as it is public and does not require permission (a receiver can request a specific permission to be called) — njzk2, Nov 22 '12 at 17:00
@njzk2 but not adding it makes it stop working? I remember i tried one time and it didn't work but my code had some issues so I'm not sure. — Gabriel Netto, Nov 22 '12 at 17:05
Does this warning get displayed still -after cleaning and rescanning Lint warnings ? I have something similar in my manifest _but no warnings_ - and trying to decide if I should add `exported="false"` or not. See also [here](http://stackoverflow.com/questions/16112470/android-exported-receiver-does-not-require-permission-on-receivers-meant-to) — Mr_and_Mrs_D, Apr 20 '13 at 15:56

score 8 · Answer 1 · edited Dec 16 '18 at 11:35

8

The warning

Exported receiver does not require permission

means, You have an intent-filter with some action (which means by default you have android:exported="true" set and it can now receive broadcasts from ANY broadcasters outside of your application) Since it can receive broadcasts from ANY broadcasters outside of your application, it warns you by saying "Hey, are you sure ANY broadcaster can invoke you? In my opinion, it is better if you allow only those broadcasters to invoke you that has the permission you have set for this receiver through android:permission"

Hope this is clear!!!

edited Dec 16 '18 at 11:35

Alireza Noorali

3,129
2
33
80

answered Dec 17 '13 at 18:08

AGK

189
2
4

2

what if it's just part of the API ? like in this example the boot complete? or like when a new camera image was taken (using this: http://java.labsoft.dcc.ufmg.br/apiminer/static/docs/reference/android/hardware/Camera.html#ACTION_NEW_PICTURE ) ? – android developer Jan 26 '14 at 10:30

score 5 · Answer 2 · edited May 23 '17 at 12:15

5

You can remove this warning by adding android:exported="false" to the receiver tag (see this answer: https://stackoverflow.com/a/11526028/757073)

edited May 23 '17 at 12:15

Community

1
1

answered Feb 13 '13 at 08:44

spes

484
5
16

7

And if you set exported to false, can it still be called when boot completed? – Xander Mar 02 '13 at 09:30

Android: OnBootReceiver: Exported receiver does not require permission

2 Answers2