Develop Reference

Secure Activities - no permission

The following is found on https://www.oreilly.com/library/view/application-security-for/9781449322250/ch04.html
with the comment "To require a certain permission to start an Activity, you need to add the permission attribute to the specific Activity’s entry in AndroidManifest.xml."
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.example.testapps.test1">
...
<activity android:name=".Activity1"
android:permission="com.example.testapps.test1.permission.START_ACTIVITY1">
<intent-filter>
...
</intent-filter>
</activity>
...
</manifest>
What should I do if I want to prevent to start the activity? Not setting the permission seems to let the activity start without any permission...

If you don't want the activity to be launched then use the following to mark it as disabled.
android:enabled="false"

What should I do if I want to prevent to start the activity?
Remove the <intent-filter>. Your <intent-filter> is saying "I want other apps to start this activity". Activities without an <intent-filter> can still be started by your app, used in PendingIntent objects, etc.

How to choose an activity as a starter activity while launching an app?

I come up with a strange problem while trying to set "SignUpActivity" as my starter activity. I tried different ways but either I am getting an error or "mainActivity" is popping up as a starter activity.
My "AndroidManifest.xml" file has the following code.
<activity
android:name=".SignUpActivity">
<intent-filter>
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.LAUNCHER" />
<action android:name="android.intent.action.VIEW" />
</intent-filter>
</activity>
<activity
android:name=".MainActivity" />
the above code gives me the error as shown in image
As the error states activity must be exported or contain an intent-filter
so, I did
<activity
android:name=".MainActivity"
android:exported="true"/>
and also tried adding intent-filter to activity. Of course, these methods make error go away but my app starts with MainActivity, not with SignUpActivity. What should I do to slove this issue?

Your AndroidManifest.xml is set correctly, check your run/debug configuration is set to 'App', not 'MainActvity'
If the 'App' configuration is missing - you will need to add it by first selecting 'Edit Confurations'
There are similar posts about this error msg.

Check the run configuration , probably you need to edit the app configuration and choose it to run.

As guided by #Eric I selected an option "app" from the run configuration which solved my problem. Previously, somehow it was set to MainActivity which was causing the issue. I have attached an image to demonstrate the solution for future readers.

Shortcut Can't Start Activity

I created some shortcut of my activities by code, most of them can't
open its related activity. I found that it only work if I added
filter CREATE_SHORTCUT to activity. Why?
<activity
android:name=".ui.Main"
android:launchMode="singleTop"
android:screenOrientation="portrait"
android:theme="#android:style/Theme.NoTitleBar" >
<intent-filter>
<action android:name="android.intent.action.CREATE_SHORTCUT" />
<category android:name="android.intent.category.DEFAULT" />
</intent-filter>
</activity>
(test in Go Launcher & MIUI 2.3.7)
I got logs below, should I add MAIN filter?
09-27 13:34:44.075: E/Launcher(7893): Launcher does not have the
permission to launch Intent { act=android.intent.action.VIEW
flg=0x10000000 cmp=/.ui.Activity2 bnds=[349,76][469,211] }. Make
sure to create a MAIN intent-filter for the corresponding activity
or use the exported attribute for this activity.

As the error message suggests, you could add
android:exported="true"
to your activity.
Although this should be the default value if I read the android documentation right:
android:exported
Whether or not the activity can be launched by
components of other applications — "true" if it can be, and "false" if
not. If "false", the activity can be launched only by components of
the same application or applications with the same user ID. The
default value depends on whether the activity contains intent filters.
The absence of any filters means that the activity can be invoked only
by specifying its exact class name. This implies that the activity is
intended only for application-internal use (since others would not
know the class name). So in this case, the default value is "false".
On the other hand, the presence of at least one filter implies that
the activity is intended for external use, so the default value is
"true".
Maybe someone else can clarify this.

Launching given activities directly

I'd like to create run configurations within Eclipse to launch a given Android activity directly so I don't have to run through my entire application to get to it. In my manifest, I've declared the activity like so:
<activity
android:name=".AlternativeActivity"
android:label="#string/title_alternative_activity"
android:exported="true">
<meta-data
android:name="android.support.PARENT_ACTIVITY"
android:value="com.mysite.AlternativeActivity" />
<intent-filter>
<action android:name="android.intent.action.MAIN" />
</intent-filter>
</activity
However, in Eclipse, I'm seeing the following warning:
Exported activity does not require permission.
How do I resolve this warning?

Exported activities (activities which either set exported=true or
contain an intent-filter and do not specify exported=false) should
define a permission that an entity must have in order to launch the
activity or bind to it. Without this, any application can use this
activity.
Protip: Place your cursor on the warning, press CTRL + 1 and select "Explain Issue".

Can you define an Android intent-filter using a string resource?

I wanted to define the string name of my intent in the strings.xml file, and then bind that string to an intent filter, as so:
<intent-filter >
<action android:name="#string/app_intent" >
</action>
<category android:name="android.intent.category.DEFAULT" >
</category>
</intent-filter>
When i tried this however, i get various errors about the system could find no activity to handle my intent. I was trying to keep values (ie, the intent names) centralized instead of hard-coded in the manifest as well as in code. As it is, at least this lets me centralize it out of the application code, but i still have it hard-coded in the manifest.
Is this really impossible to do or is there some way to make it work?

Its not the issue with intent-filter, the issue is with android:name. android:name attribute is not taking string resource for activity name also. example <activity android:name="#string/app" android:label="#string/app_name"> is not valid in android.

Not directly answering the OP's question, but what drove me to this question was that I wanted to be able to define different actions in different situations (including defining an action triggering a component in android library in the application using this library). I eventually found about manifest placeholders, which were actually what I needed. Hopefully, this will be useful for someone else too.
PS: Yes, defining a placeholder in the app still allows you to use it in a library, because of the manifest merging happening at build time.