Deep Link与回调URL安全校验（移动端URL Scheme）最佳实践

一、白名单与验证const allowSchemes = new Set(['myapp']) const allowDomains = new Set(['example.com','app.example.com']) function validScheme(s: string): boolean { return /^[a-z][a-z0-9+\-.]*$/.test(s) && allowSchemes.has(s) } function validDomain(d: string): boolean { return allowDomains.has(d.toLowerCase()) } 二、状态参数与签名import crypto from 'crypto' function signState(state: string, secret: Buffer): string { return crypto.createHmac('sha256', secret).update(state).digest('hex') } function verifyState(state: string, sig: string, secret: Buffer): boolean { return signState(state, secret) === sig } 三、回调URL过滤function sanitizeCallback(u: string): { ok: boolean; url?: string } { try { const x = new URL(u) if (!validDomain(x.hostname)) return { ok: false } if (!/^\/callback\/[a-z0-9_\-]+$/.test(x.pathname)) return { ok: false } const next = new URL(x.origin + x.pathname) return { ok: true, url: next.toString() } } catch { return { ok: false } } } 四、服务端校验示例type Req = { query: Record<string, string | undefined> } type Res = { status: (n: number) => Res; end: (b?: string) => void; redirect: (url: string) => void } function handleCallback(req: Req, res: Res, secret: Buffer) { const state = req.query['state'] || '' const sig = req.query['sig'] || '' const cb = req.query['cb'] || '' if (!verifyState(state, sig, secret)) return res.status(401).end('invalid_state') const s = sanitizeCallback(cb) if (!s.ok || !s.url) return res.status(400).end('invalid_callback') res.redirect(s.url) } 五、客户端触发示例（兼容）function openDeepLink(state: string, sig: string) { const scheme = 'myapp://open?state=' + encodeURIComponent(state) + '&sig=' + encodeURIComponent(sig) const universal = 'https://app.example.com/open?state=' + encodeURIComponent(state) + '&sig=' + encodeURIComponent(sig) const a = document.createElement('a') a.href = scheme document.body.appendChild(a) a.click() setTimeout(() => { window.location.href = universal }, 1500) } 六、验收清单Scheme与域名白名单生效；回调路径限制到`/callback/{id}`形式；拒绝非白名单或异常路径。`state`与签名校验通过；回调仅使用规范化URL，避免Open Redirect。客户端深链与通用链接兼容触发；失败时回退到通用链接。