Getting Permission Denial Exception

Please check these questions too:
Android KitKat securityException when trying to read from MediaStore
Permission denial: opening provider

For the same problem on KitKat, I used this. It's an option/workaround I had found from one of the Stack Overflow links, you will be able to select files from Downloads/Recent.

public static final int KITKAT_VALUE = 1002;

Intent intent;

if (Build.VERSION.SDK_INT < 19) {
    intent = new Intent();
    intent.setAction(Intent.ACTION_GET_CONTENT);
    intent.setType("*/*");
    startActivityForResult(intent, KITKAT_VALUE);
} else {
    intent = new Intent(Intent.ACTION_OPEN_DOCUMENT);
    intent.addCategory(Intent.CATEGORY_OPENABLE);
    intent.setType("*/*");
    startActivityForResult(intent, KITKAT_VALUE);
}

@Override
public void onActivityResult(int requestCode, int resultCode, Intent data) {
    if (requestCode == KITKAT_VALUE ) {
        if (resultCode == Activity.RESULT_OK) {
            // do something here
        }
    }
}

Reference: Android Gallery on KitKat returns different Uri for Intent.ACTION_GET_CONTENT http://developer.android.com/guide/topics/providers/document-provider.html#client

When control and data is returned to your activity in

protected void onActivityResult(int reqCode, int resultCode, Intent data)

your activity, at the same time, is given permissions to access the image url in the passed intent. Your activity will be able to read the url in the intent and display the image. But you wont be able to pass any permissions on to other activities or to a new thread of execution. That is why you are getting the SecurityException for android.permission.MANAGE_DOCUMENTS.

One way to avoid your permission issue, is just to get the data in the activity that has permissions. In your case, from the activity that has permission do your encoding

InputStream is = getContentResolver().openInputStream(uri);
byte[] inputData = getBytes(is);
is.close();
String encoded = Base64.encodeToString(inputData, Base64.DEFAULT);

Once you have your encoded string you can pass it to any other activities that might need it, or you can pass it to an AsyncTask to be sent elsewhere.

Make sure you're using the ContentResolver from the Activity that requested the content, for instance:

activity.getContentResolver()  

Instead of MyApp.getContext().getContentResolver()

It was apparently the case for me and it didn't need to add the android.permission.MANAGE_DOCUMENTS to the manifest.

And that you call the intent using this:

if (android.os.Build.VERSION.SDK_INT < Build.VERSION_CODES.KITKAT) {
    intent.setAction(Intent.ACTION_GET_CONTENT);
} else {
    intent.setAction(Intent.ACTION_OPEN_DOCUMENT);
    intent.addCategory(Intent.CATEGORY_OPENABLE);
}

more info: https://developer.android.com/guide/topics/providers/document-provider.html#client

Writing ACTION_OPEN_DOCUMENT is not helping entirely. After a restart your URI Permission is gone even with this action.

   if (android.os.Build.VERSION.SDK_INT < Build.VERSION_CODES.KITKAT) {
            intent.setAction(Intent.ACTION_GET_CONTENT);
        } else {
            intent.setAction(Intent.ACTION_OPEN_DOCUMENT);
            intent.addCategory(Intent.CATEGORY_OPENABLE);
        }

To complete Alécio Carvalho's answer look at this documentation on the same page. There is a good explanation regarding URI Permissions and how to make them persist.

Just add this to your onActivityResult method and your permission persists through a device restart. (Tested with a Google Pixel.)

override fun onActivityResult(requestCode:Int, resultCode:Int, intent:Intent?) {
if(requestCode == SELECT_PICTURE && intent != null){
    val uri = intent.getData()
    val takeFlags = intent.getFlags() and (Intent.FLAG_GRANT_READ_URI_PERMISSION or Intent.FLAG_GRANT_WRITE_URI_PERMISSION)
    activity.getContentResolver().takePersistableUriPermission(uri, takeFlags)
    PreferenceHelper.setHeaderImageUri(activity, uri.toString())
  }
}

(sorry kotlin lover...java version is inside the link)