I am developing an app and the manifest has included permissions INTERNET and SEND_SMS. There was no asking of permissions when the apk was installed by Android Studio to either an emulator or a real phone.
When I ran the app, which sends an SMS, there was a permission exception. I had to go to Settings, Apps and under Permissions, there is an option to enable SMS. After I enabled it, the app could send SMS'es.
When the app made a network call using HttpUrlConnection, it completed successfully! Under Settings Apps, there is no option for network or Internet or the like.
Why is it that making a network communication does not require any permission by the user?
Under Settings, Apps, why is there only one permission, SMS, listed for my app?
It's the developer responsibility to request the permission at the runtime.
Before accessing any danger permission. (Runtime Permission are supported from Android M(6.0))
Not all the permission need to be requested from the user. Only Danger Permission needs an approval from the user. Normal and Danger Permsission
Please follow this guide Runtime Permission
The permissions model was changed in Android 6.0. If the app targets API 23 or above than you need to request the user for the permissions in runtime. If the app targets below API 23 than the app gets the permissions during intall.
There are some permissions like "INTERNET" that will always be during intall.
You're running your app in Android SDK>=23.
Internet permission is under Normal permission so it does not show any permission prompt but Camera permission is under Dangerous Permission so it shows permission prompt.
If an app declares that it needs a normal permission, the system automatically grants that respective permission to the app.
Refer:
Reference -
Android Permissions
StackOverflow
Permission Requests
Related
According to react-native-firebase documentation in Notifications/Receiving notifications: Before you are able to send and receive Notifications, you need to ensure that the user has granted the correct permissions.
However, I can normally receive a push notification from the server which can open the application by tapping it, even though I haven't checked and requested any permission before. I've tested on Android only.
So my question is whether it is necessary to setup permission handling if the only thing required is to receive notifications from the server without handling them in the app.
As you can see here, in Android, notifications permission is in Normal permissions group and not in Dangerous permissions.
As mentioned:
If an app declares in its manifest that it needs a normal permission, the system automatically grants the app that permission at install time.
And:
To use a dangerous permission, your app must prompt the user to grant permission at runtime.
That's why your notification works without granting user's permission in runtime.
But for iOS, you must grant user's permission at runtime or it will not work.
I read that with Android 6.0, users need to manually allow apps to hold this permission by going to app advanced settings and enabling "Draw over other apps". I have a Nexus 5 with Android 6.0 but I don't seem to be prompted to enable this setting. When I install apps from the Play Store that require this permission, such as LastPass, it gets granted automatically.
Why is this so?
It is a new behaviour introduced in Marshmallow 6.0.1.
Every app that requests the SYSTEM_ALERT_WINDOW permission and that is installed through the Play Store (version 6.0.5 or higher is required), will have granted the permission automatically.
If instead the app is sideloaded, the permission is not automatically granted. You can try to download and install the Evernote APK from apkmirror.com. As you can see you need to manually grant the permission in Settings -> Apps -> Draw over other apps.
[The above information is from this post.]
If you want the app to be sideloaded, you show manually show a prompt and direct the user to enable Draw over other apps permissions from the settings. Have a look at Requesting permissions
Every app that requests the SYSTEM_ALERT_WINDOW permission and that is installed through the Play Store (version 6.0.5 or higher is required), will have granted the permission automatically.
Click here! This may help
There are mainly two types of permissions, they are
Normal Permissions
Dangerous Permissions
Normal permissions indicates that there's no great risk to the user's privacy or security in letting apps have those permissions. For example, users would reasonably want to know whether an app can read their contact information, so users have to grant this permission explicitly. By contrast, there's no great risk in allowing an app to vibrate the device, so that permission is designated as normal.
Dangerous permissions cover areas where the app wants data or resources that involve the user's private information, or could potentially affect the user's stored data or the operation of other apps. For example, the ability to read the user's contacts is a dangerous permission. If an app declares that it needs a dangerous permission, the user has to explicitly grant the permission to the app.
In this case, SYSTEM_ALERT_WINDOW comes under Normal permissions, that is if an app declares in its manifest that it needs a normal permission, the system automatically grants the app that permission at install time. The system does not prompt the user to grant normal permissions, and users cannot revoke these permissions.
You can see the list of normal permissions in this link and dangerous permissions here.
A small question: I am trying to debug my App, developing in Android Studio, with my Smartphone. I have listed several uses-permission in my manifest. But when I debug the app, the smartphone does not ask me for the permission to use the permissions... will I nevertheless have access to my "uses-permission" permissions? If not, how can I debug it :D
Runtime permissions are a new thing on Android. They only work if your both Target API and the device you are using are level 23 or higher. If any of those is lower, then Runtime permissions do not work and old permission model is used. In old model, permissions are granted at install time and when you install your app via USB, you automatically accept all permissions. Still, in new permission model, you need to write code in async style, meaning that first you have to ask user for permission and supply a callback, in which you will know whether the user granted or denied specific permission. You can read more about that at officials docs.
I am going to update an application to Android 6.0. For users who already have the application installed when an update is made, are all the permissions still active or is the user going to be asked for permissions that are in the dangerous category?
It will still ask them to allow those permissions if they are in the dangerous category, regardless if they are specified in the manifest. (i.e Writing to SD, Using the camera) See Permission Groups
If you have users who are on Android 6.0 Marshmallow and your application only specifies permissions in the manifest and not at run time then those actions will fail. For example, if you have code that writes to the external storage, it will fail and give a Permission Denied error.
Regarding Google's recent announcement about Android M and Permissions model.
Per the official Android documentation:
Limited Permissions Granted at Install Time: When the user installs or
updates the app, the system grants the app all permissions that the
app requests that fall under PROTECTION_NORMAL. For example, alarm
clock and internet permissions fall under PROTECTION_NORMAL, so they
are automatically granted at install time. The system may also grant
the app signature and system permissions, as described in System apps
and signature permissions. The user is not prompted to grant any
permissions at install time.
Particular note that it says:
...the system grants the app all permissions that the app requests.
So, if the app does not have INTERNET permission in its AndroidManifest.xml, it won't be granted access to INTERNET in that case?
Or will an app require to add INTERNET permission in its manifest in order to be able to make network calls?
As for the specific android.permission.INTERNET permission, it is still mandatory for apps that will access the Internet. If a developer were to publish an app without defining it in the Android manifest, an exception will be thrown the first time a connection attempt is made, and the app will possibly crash. This is no different than before.
All that has changed is that there won't be a prompt to the user, the app will still require the permission in the manifest.
Please check this video from Google IO - https://youtu.be/f17qe9vZ8RM?t=18m10s
There is no more Internet permission - the app will have by default access to the internet. Their idea is that if you don't have access to the device data then you can not do anything dangerous
Kind Regards