IIS Express and Kestrel Debugging Ports May Bind to All Interfaces, Allowing LAN Access

Whether a remote LAN client can access a debugging port depends on the specific launch profile used and the resulting socket binding. While the browser defaults to localhost, the underlying listener may be configured to accept traffic from any interface.

Binding Behavior and Host Headers

The IP address and Host header used depend on the server implementation:

• IIS Express: Bindings are stored in .vs/config/applicationHost.config. A common default is *:port:localhost. The * indicates a wildcard IP binding (listening on all interfaces), but the localhost suffix acts as a Host header filter.
• Kestrel: Bindings are defined in launchSettings.json via applicationUrl. http://localhost:port binds strictly to the loopback interface. http://0.0.0.0:port or http://*:port binds to all IPv4 interfaces.

Can a remote LAN client retrieve the application?

Potentially, but it depends on the Host header. If a socket is bound to 0.0.0.0 (wildcard), the port is open to the LAN. However, if the server is configured to only respond to Host: localhost (common in IIS Express), a remote client requesting http://[LAN-IP]:port will likely receive a 400 Bad Request or a 404, because the browser sends the LAN IP as the Host header, not localhost.

Comparison: IIS Express vs. Kestrel

The behavior is not the same for both profiles:

Feature	IIS Express	Kestrel (Default)
Default Binding	Often wildcard (*)	Usually loopback (localhost)
Host Header Check	Strictly enforced via config	Generally permissive unless middleware is added
LAN Reachability	Socket open, but Host header often blocks	Socket usually closed to LAN entirely

Verification Steps

To confirm if your specific environment is exposed, use these scoped commands:

1. Check the Socket: Run the following in PowerShell to see if the port is listening on 0.0.0.0 (All) or 127.0.0.1 (Loopback):
   

   Get-NetTCPConnection -LocalPort [YourPort] | Select-Object LocalAddress, LocalPort, State

2. Inspect Configuration: Check .vs/config/applicationHost.config for IIS Express bindings or launchSettings.json for Kestrel applicationUrl.
3. Test LAN Access: From a separate machine on the same network, attempt to browse to http://[Your-LAN-IP]:[Port].

Required Diagnostic Detail: To provide a definitive answer for your specific case, please provide the exact binding string found in your applicationHost.config or launchSettings.json.