4 ms·

No, JavaScript running in your browser can connect to it. No remote access required. Of course, if you do allow remote access it is even worse.

• dboreham 5y ago
  Wait, the browser allows random http connections to localhost from JS fetched from any domain?? Edit: after reading tfa, it appears: no it can't , but it may due to browser security vulnerabilities.
  • nitrogen 5y ago
    Do browsers block access to 192.168/16 or 10/8 etc?
  • AntonyGarand 5y ago
    It does, if the server accepts the connection there is nothing preventing it. This is frequently used by apps which are installed on your machine but are accessed by links, such as zoom and discord. I think Zoom removed its server after receiving pressure[0] about it, but discord still does it: Head to https://discord.com/invite/test https://discord.com/invite/test and it should open your local discord client, or checking the network requests will reveal up to 10 attempted local ports. [0] https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-macs-after-security-report/ https://www.zdnet.com/article/zoom-defends-use-of-local-web-...