public enum TapjackingPolicy

ImplementsComparable<TapjackingPolicy>

What the framework should do about a touch that arrives while another application’s window is drawn over this app. See DeviceIntegrity.setTapjackingProtection(TapjackingPolicy).

The distinction that matters here is between fully and partially obscured. Android reports them as two different flags, and they carry very different signal-to-noise:

Fully obscured means another window sits directly over the point that was touched. That is the tapjacking attack itself, and it is rare enough in normal use that blocking on it is safe.
Partially obscured means some other window covers part of this app’s window, anywhere. Benign system UI sets it routinely, so treating it as an attack will drop legitimate taps.

That is why BLOCK stops at the first and STRICT is a deliberate opt-in to the second.

Enum constants

`OFF`	No detection and no reporting.
`REPORT`	Observe and report, but never change event delivery.
`BLOCK`	Report, and drop any gesture that begins on a fully obscured window.
`STRICT`	As `BLOCK`, and additionally drop gestures that arrive while the window is only partially obscured.

Methods

`public static` `TapjackingPolicy[] values()`
`public static` `TapjackingPolicy valueOf(String name)`
`public boolean isDetecting()`	Whether this policy wants the platform to look at the obscured flags at all.
`public boolean blocks(boolean obscured, boolean partiallyObscured)`	Whether a gesture carrying these obscured flags should be dropped rather than delivered.

Inherited methods

From Enum

clone, setEnumValues, getEnumValues, valueOf, equals, hashCode, toString, compareTo, name, ordinal, getDeclaringClass

From Object

getClass, notify, notifyAll, wait, wait, wait

Enum constant details

OFF

OFF

No detection and no reporting. This is the default: the check costs nothing but an app that never asked for it should not start seeing signals, and blocking touches is not a behaviour to switch on behind a developer’s back.

REPORT

REPORT

Observe and report, but never change event delivery. Touches are dispatched exactly as they would be with OFF, while DeviceIntegrity.isScreenObscured(), the tapjacking listeners and the ShieldSignal.TAPJACK signal all become live.

Use this to measure how often obscuring actually happens in your user base before you commit to dropping input.

BLOCK

BLOCK

Report, and drop any gesture that begins on a fully obscured window. The recommended setting for a sensitive app.

The whole gesture is dropped, not the individual event: swallowing a press while letting the matching release through would leave the framework holding half a gesture.

STRICT

STRICT

As BLOCK, and additionally drop gestures that arrive while the window is only partially obscured.

Understand the cost before choosing this. The partial flag is set by ordinary system UI, so on some devices this will discard taps the user meant, and the app will read as unresponsive with nothing in the logs to explain it. Reach for it only where a missed tap is clearly preferable to a hijacked one.

Method details

values

public static TapjackingPolicy[] values()

valueOf

public static TapjackingPolicy valueOf(String name)

isDetecting

public boolean isDetecting()

Whether this policy wants the platform to look at the obscured flags at all. False only for OFF, which is what lets a port skip the check entirely on the hot input path.

blocks

public boolean blocks(boolean obscured, boolean partiallyObscured)

Whether a gesture carrying these obscured flags should be dropped rather than delivered.

This is the whole blocking decision, kept here as pure logic so it is identical on every port and can be tested without a device.

Parameters

obscured boolean: another window sits directly over the touched point
partiallyObscured boolean: another window covers some part of this app’s window

Returns

true if the gesture must not be delivered to the application