We have an Android app that makes use of Firebase for push notifications so we are registering a broadcast receiver of type com.google.firebase.iid.FirebaseInstanceIdReceiver.
It's being questioned whether or not we need to export the receiver in the apps manifest, currently we are.
Is it required to export this receiver in order for the Firebase functionality to work?
This post answered my question, it seems like it does need to be exported but is protected by a permission that only system apps should have:
How is Android Firebase messaging SDK secure against Intent spoofing?
If you don't add your custom FirebaseInstanceIdReceiver in your AndroidManifest your Custom class will not work. So firebase will continue to function but you will not be able to receive refreshed token.
