IIS Express and Kestrel Debugging Ports May Bind to All Interfaces, Allowing LAN Access
Visual Studio launches IIS Express or Kestrel for local web projects, and the browser typically displays localhost. The underlying socket may listen on 0.0.0.0, making the debugging endpoint reachable from any device on the same LAN. Verification requires inspecting the site binding in the .vs folder’s applicationHost.config and confirming the listening addr
visualstudio