How should a Flutter app properly handle a deep link that points to a specific screen requiring the user to first be authenticated, if that user is not actually currently logged in yet?

Intermediate

Answer

When a deep link points to a screen that genuinely requires the user to already be authenticated, but that user is not actually currently logged in, a well designed app should typically redirect them first to the login screen, while carefully remembering the originally intended deep link destination, then automatically continue on and navigate them to that originally intended destination screen immediately after they have actually successfully completed the login process, rather than either failing the deep link entirely or confusingly dropping the user onto the app's generic default home screen instead.

GoRoute(
  path: '/orders/:id',
  redirect: (context, state) {
    if (!isLoggedIn) return '/login?redirect=${state.uri}';
    return null;
  },
)

Real-world example A banking app redirects a user tapping a deep link to a specific transaction detail screen to the login screen first if they are not currently authenticated, then automatically continues on to display that exact same originally intended transaction screen immediately after they successfully log in.

Common follow-ups: How do you properly preserve and later restore the original deep link target throughout a multi step login flow?;What security considerations apply when handling a deep link that leads to sensitive account information?

Firebase Authentication in Flutter;Flutter App Security Best Practices

All 7 Deep Linking in Flutter questions