2

While developing web software, I typically run a browser (chrome) from my IDE. Here's an example launch.json in VSCode:

{
    // Use IntelliSense to learn about possible attributes.
    // Hover to view descriptions of existing attributes.
    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
    "version": "0.2.0",
    "configurations": [
        {
            "name": "vite dev",
            "type": "node",
            "request": "launch",
            "cwd": "${workspaceFolder}",
            "runtimeExecutable": "yarn",
            "runtimeArgs": ["dev"],
            "serverReadyAction": {
                "action": "debugWithChrome",
                "pattern": "127.0.0.1:.*m([0-9]+)",
                "uriFormat": "http://127.0.0.1:%s",
                "killOnServerStop": true
            }
        }
    ]
}

This launches a chrome instance with a separate configuration to my default one. Additionally, my IDE is attached.

Often, I use the same instance to lookup documentation on public websites with 3rd party content.

I'm looking for a browser agnostic answer. Is public browsing in such an instance significantly more risky or dangerous?

4
  • whenever you have something running on localhost, there is a risk that a web site could access it. So the security of whatever is running as localhost is important. This would be the same risk from any browser session, except that if an attacker can run code, they can also hook into your debug session of the browser. (they just need the port) Remember also that the IDE can inject code into the browser, so if that is compromised, they can bypass the sandbox. Commented Aug 10, 2023 at 19:44
  • @pcalkins that's a valid inside risk where local resources are connecting locally. However, I'm more concerned about 3rd party (external) websites exploiting something. Commented Aug 15, 2023 at 18:20
  • a remote site could probe to see if a localhost is accepting requests and if it's not secure could exploit it. (doesn't matter if it's a debug session of the browser or not, just whether something is running on localhost that accepts incoming requests) Commented Aug 15, 2023 at 18:36
  • I think such an attack would be extremely difficult to carry as the attacker is most likely blind and clueless about the localhost web app. Doesn't say it does not happen, but anyway it has nothing to do with the IDE. For me it makes no difference that the Chrome instance is launched from the IDE in that case.
    – bsaverino
    Commented Dec 8, 2023 at 21:10

1 Answer 1

2

Is public browsing in such an instance significantly more risky or dangerous?

If this instance uses an up to date web browser, it shouldn't be any riskier than using a full fledged separate web browser.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .