How to handle SYSTEM_ALERT_WINDOW permission not being auto-granted on some pre-Marshmallow devices

Handling SYSTEM_ALERT_WINDOW Permission on Pre-Marshmallow Devices

The SYSTEM_ALERT_WINDOW permission allows apps to draw on top of other apps, which is essential for features like overlay views, floating widgets, and accessibility services. However, on Android versions prior to Marshmallow (API level 23), this permission is automatically granted at installation, leading to potential security concerns.

This article will guide you through the challenges and solutions for handling the SYSTEM_ALERT_WINDOW permission on pre-Marshmallow devices.

The Challenge: Auto-Granting on Pre-Marshmallow

Pre-Marshmallow devices automatically grant the SYSTEM_ALERT_WINDOW permission upon installation, without requiring explicit user consent. This can create vulnerabilities:

Potential Security Risks

• Malicious Apps: Untrusted apps can gain access to sensitive information displayed by other apps.
• User Experience Issues: Unnecessary overlays can interfere with the user’s interaction with the device.
• Privacy Concerns: Users may be unaware of apps accessing sensitive information displayed by other apps.

Solutions:

While there’s no direct way to prevent automatic granting of the SYSTEM_ALERT_WINDOW permission on pre-Marshmallow devices, there are strategies to mitigate the risks and enhance user security:

1. Use Permissions API (API Level 23 and Above)

The Permissions API introduced in Android Marshmallow provides a mechanism to request permissions at runtime. If your target API level is 23 or higher, you can request the SYSTEM_ALERT_WINDOW permission using the following code:

if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
    if (!Settings.canDrawOverlays(this)) {
        Intent intent = new Intent(Settings.ACTION_MANAGE_OVERLAY_PERMISSION,
                Uri.parse("package:" + getPackageName()));
        startActivityForResult(intent, REQUEST_CODE_OVERLAY_PERMISSION);
    }
}

When using the Permissions API, you’ll need to handle the user’s response (granted or denied) and accordingly enable or disable functionality requiring this permission.

2. Educate Users (Pre-Marshmallow)

Since you cannot request the permission at runtime on pre-Marshmallow devices, you must educate users about the potential security risks and implications:

• App Description: Clearly explain in the app’s description why the SYSTEM_ALERT_WINDOW permission is necessary and how it will be used.
• In-App Notices: Upon launch, display a notice informing users that the app has access to display overlays. Offer a way to access device settings and disable the permission if desired.
• User Guides: Provide comprehensive documentation outlining the app’s functionality and the use of SYSTEM_ALERT_WINDOW permission.

3. Alternative Approaches

In some cases, you might consider alternative approaches to achieve the desired functionality without relying on the SYSTEM_ALERT_WINDOW permission on pre-Marshmallow:

• Notifications: Use notifications to display information or provide options for interaction. However, notifications are limited in visual customization and interactivity.
• Dialog Boxes: Implement dialog boxes to display content or solicit user input. These might not be as visually appealing or interactive as overlays but are a reasonable alternative.
• Custom Views: Explore the possibility of using custom views within the app’s existing layout to provide similar functionalities without needing overlays.

Considerations and Best Practices

When working with the SYSTEM_ALERT_WINDOW permission, remember:

• Minimize Impact: Only request this permission when truly necessary and ensure the overlay is unobtrusive and serves a clear purpose.
• Transparency: Be transparent with users about the app’s use of the permission and provide ways for them to control it.
• Respect User Choices: If the user denies the permission, gracefully handle it by offering alternative functionalities or disabling features that require the permission.
• Code Quality: Ensure your code handles permission requests and user responses properly to avoid security vulnerabilities.

Table Comparison

By understanding the intricacies of SYSTEM_ALERT_WINDOW permission management on pre-Marshmallow devices, you can develop secure and user-friendly applications.