GEO-101 · Mobile app association files are served correctly
apple-app-site-association and assetlinks.json must be served without redirects, as JSON, naming the configured apps.
- Evidence class
- E1
- Weight
- 2
- Subject
- one site subject
- Scope
- URL
- Default severity
- medium
- Lifecycle
- stable
- Platforms
- Any web stack
Sub-checks
A subject fails if any evaluated sub-check fails, and passes only when every applicable sub-check ran and passed. url sub-checks need a URL; both can also run from source.
| Sub-check | Scope | Checks that |
|---|---|---|
aasa | url | /.well-known/apple-app-site-association names the configured appIDs |
assetlinks | url | /.well-known/assetlinks.json names the configured package and fingerprints |
Preconditions
- profile is app and appLinks is configured; otherwise not applicable
Remediation
Serve the association files at the documented paths with a 200, application/json, and no redirect.
Fix class: guarded (Phase 2)
G4Phase 2, not in this release
Evidence
Platform policies and standards are cited as such; anything else is labelled guidance. These links were carried forward from the specification and should be rechecked before quoting them as current policy.
- Apple: supporting associated domains (platform-policy)
- Android: verify App Links (platform-policy)
Run it
npx geopilot explain GEO-101
npx geopilot scan . --rule GEO-101