Universal Links are properly configured for iOS
Why it matters
Without a valid apple-app-site-association file, iOS treats your HTTPS links as ordinary web URLs and opens them in Safari instead of launching your app. Users who tap a password-reset link, a share URL, or a post-purchase confirmation get dropped into a browser session with no app context — they abandon, or worse, complete a flow in an unsupported UI path. Apple's Universal Links spec (apple-universal-links) requires server-side verification; if /.well-known/apple-app-site-association is missing or misconfigured, the OS silently falls back to Safari with no error shown to the user or the developer.
Severity rationale
High because misconfigured Universal Links silently break every HTTPS deep link on iOS, routing users to a browser instead of the app and degrading retention, re-engagement, and post-purchase flows.
Remediation
Place the apple-app-site-association file at ios/apple-app-site-association and ensure it is also served at https://<your-domain>/.well-known/apple-app-site-association with Content-Type: application/json and no redirect.
{
"applinks": {
"apps": [],
"details": [
{
"appID": "TEAM_ID.com.yourcompany.appname",
"paths": ["/*"]
}
]
}
}
For Expo-managed builds, add the domain to app.json instead:
{
"ios": {
"associatedDomains": ["applinks:myapp.com"]
}
}
Replace TEAM_ID with your Apple Developer Team ID. Verify the file is reachable and returns HTTP 200 before submitting to the App Store.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Mobile Navigation & Deep Linking Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · apple-universal-links — Supporting Universal Links in Your App
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mobile-navigation-linking·automated