How to set permissions in broadcast sender and receiver in android

Question

How do we specify in broadcast sending application that which application can receive this broadcast, and in receiving application that which particular application has the

Answer 1

After half day search and test, based on @JFL's answer, I find the sender app must add both <permission> tag and <uses-permission> tag, then the receiver can receive the broadcast with permission. Otherwise, the receiver app won't receive the broadcast.

Answer 2

Declare permission

First you need declare your permission in your AndroidManifest.xml

<permission android:name="YOUR_PERMISSION_STRING" android:protectionLevel="signature"/>
<uses-permission android:name="com.codylab.photogallery.PRIVATE"/>

the android:name value is used as permission value and will used later.

Usage

There are two kinds of permission usages related to broadcast receiver:

(1) Control which application can receive your broadcast:

String PERMISSION_STRING_PRIVATE_RECEIVER = "YOU_NEED_THIS_TO_RECEIVE_THIS_BROADCAST"
sendBroadcast(intent, PERMISSION_STRING_PRIVATE_RECEIVER);

With this usage, you can control only authorized application can handle the broadcast you sent.

(2) Only handle the broadcasts have the specified permission

String PERMISSION_STRING_PRIVATE_BROADCASTER = "ONLY HANDLE BROADCASTS WITH THIS PERMISSION"
IntentFilter filter = new IntentFilter(ACTION_SAMPLE);
registerReceiver(mReceiver, filter, PERMISSION_STRING_PRIVATE_BROADCASTER, null);

With this usage, you can make sure that the broadcaster is authorized.

Answer 3

To control who is able to receive the broadcast message, you can use the method sendBroadcast:

public abstract void sendBroadcast (Intent intent, String receiverPermission)

where you precise the name of the required permission. If the receiver does not declare this permission, it will not be able to get the message. For example, the broadcast sender can do:

Intent broadcast = new Intent(this, MyBroadcastReceiver.class);
sendBroadcast(broadcast, "andro.jf.mypermission");

In the manifest of the broadcast sender, a new permission should be declared:

<!--  Declaring the special permission -->
<permission android:name="andro.jf.mypermission" 
        android:label="my_permission" 
        android:protectionLevel="dangerous"></permission>

Then, in the application that is supposed to receive this broadcast, you have to declare this permission and say that you use it. In the manifest you can add:

<!--  I use the permission ! -->
<uses-permission android:name="andro.jf.mypermission"/>

and of course, you have to declare your broadcast receiver:

<receiver android:name="MyBroadcastReceiver" android:exported="true" />

You can have a look at this post for a complete example of a custom permission and also the android developer page about this. Be carefull with the order of installation of your apps because the one that defines the permission should be installed first.

Answer 4

use an intent filter in receiver tag in manifest

 <receiver
    android:name="Your receiver"
    android:enabled="true"
    android:exported="false" >
    <intent-filter>
        <action android:name="action"/>
        <category android:name="category" />
    </intent-filter>
</receiver>

To send broadcast to app

   Intent intent = new Intent();
   intent.setAction("use same action in receiver");
   intent.addcategory("use same category in receiver");
   context.sendBroadcast(intent); 

Answer 5

If you want to restrict who only can send intents to your broadcast receiver, do it this way:

The broadcast receiver:

<manifest ...>

    <!-- Permission declaration -->
    <permission android:name="my.app.PERMISSION" />

    <receiver 
        android:name="my.app.BroadcastReceiver"
        android:permission="my.app.PERMISSION"> <!-- Permission enforcement for delivering intents to this receiver -->
        <intent-filter>
            <action android:name="my.app.Action" />
        </intent-filter>
    </receiver>

    ...
</manifest>

The broadcast sender:

<manifest ...>
    <!-- We declare we own the permission to send broadcast to the above receiver -->
    <uses-permission android:name="my.app.PERMISSION" />

    ...
</manifest>

Sending broadcast from the sender Activity to the receiver:

Intent intent = new Intent();
intent.setAction("my.app.Action");
activity.sendBroadcast(intent);

If you declare the permission like this:

<permission android:protectionLevel="signature" android:name="my.app.PERMISSION" />

Then the sender will be able to use this permission and send broadcasts to receiver only when both the sender and the receiver apps are signed by the same developer certificate.