Skip to content

FLAG_SECURE not applied before Activity onCreate — App Switcher thumbnail visible #1

Description

@madfortech

When NoScreenshot::disableGlobally() is called inside a controller or ServiceProvider::boot(), the FLAG_SECURE flag is applied after the WebView loads.
As a result, when the user presses the Home button, Android captures the app thumbnail before FLAG_SECURE is active — making the app screen visible in the App Switcher / Recents.
Expected behavior:
FLAG_SECURE should be applied at Activity onCreate() level so the App Switcher thumbnail is always blocked.
Current behavior:

Screenshot inside app → ✅ Blocked (black screen)
App Switcher thumbnail → ❌ App screen visible (not blocked)

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Codingwithrk\NoScreenshot\Facades\NoScreenshot;
use Codingwithrk\NoScreenshot\Events\ScreenRecordingStarted;
use Codingwithrk\NoScreenshot\Events\ScreenRecordingStopped;
use Codingwithrk\NoScreenshot\Events\ScreenshotAttempted;

class ProtectionController extends Controller
{
    
    public function index()
    {
        // Hamesha protect karo — session se independent
        NoScreenshot::disableGlobally();

        $isProtected = session('protected', false);
        $status = NoScreenshot::getStatus();

        return view('protection.index', [
            'status' => $status,
            'isProtected' => $isProtected,
        ]);
    }

    
    public function enable()
    {
        session(['protected' => true]);
        NoScreenshot::disableGlobally();
        return redirect('/protection');
    }

    public function disable()
    {
        session(['protected' => false]);
        // Globally enable mat karo — App Switcher expose hoga
        // NoScreenshot::enableGlobally(); // ❌ Yeh mat karo
        return redirect('/protection');
    }





    // Check recording status
    public function checkStatus()
    {
        $status = NoScreenshot::getStatus();

        if ($status) {
            match (true) {
                $status->isScreenBeingRecorded => ScreenRecordingStarted::dispatch(),
                default => ScreenRecordingStopped::dispatch(),
            };
        }

        return response()->json($status);
    }

    // Manual screenshot event
    public function screenshotAttempt()
    {
        ScreenshotAttempted::dispatch();

        return response()->json([
            'message' => 'Screenshot attempt detected'
        ]);
    }
}

Help Me

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions