IIS Express and Kestrel Debugging Ports May Bind to All Interfaces, Allowing LAN Access

Visual Studio launches IIS Express or Kestrel for local web projects, and the browser typically displays localhost.

The underlying socket may listen on 0.0.0.0, making the debugging endpoint reachable from any device on the same LAN.

Verification requires inspecting the site binding in the .vs folder’s applicationHost.config and confirming the listening address with netstat or Get‑NetTCPConnection, then testing access from another LAN machine.

Which IP address and Host header does the debugging port actually use? Can a remote LAN client retrieve the application via the computer’s LAN IP and port? Does the same behavior occur for both IIS Express and Kestrel launch profiles?