This solution below applies to most versions of windows IIs local websites.
In general, no one but you can access your local website using "localhost". Thats a loopback address that always points back to the same computer and IIs website on that box. So, if another user tried to use that address, it would point back to their own default website on their IIs on their box.
But....I think your question is whether someone can access your "default website" instance on your box inside a new network. Not with "localhost", but yes, they can using either your assigned local IP or the your PC name on the network, if they could see either. So this is a very savvy question. Give yourself credit for asking it.
- They can get your local IP in the network through a ping or other means. They can then use that IP and try the 80, or 8080 port if you added that.
- They can see your computer name and that also will allow them to try the 80 or 8080 port and see your local default website in IIs. Example: "http://DavidsPC:8080" will work from someone inside a network. So, yes, they can access your website on your pc that way if someone can see your laptop name.
To prevent all this, do the following:
- Go to IIs on your laptop or PC (I right click my pc and choose "Manage" then scroll under Services and Applications). Choose Internet Information Services then look to the right pane for your website.
- Go find your assigned "default" website inside IIs. That's the one that will in general be listening to http calls from outside your box. Its usually called default unless you can changed its name. if so, see below for the black host name binding. That's the default.
- Right click that website in the tree listing, and choose "Edit Bindings"
- In there click the blank entry for your 80 and/or 8080 port for http and/or https if used.
- It should be blank under host name and "all unassigned" for IP. That means your default website will send a user's browser any response where they have typed on the browser address bar, the PC network name or local network IP and port combp assigned to that box. Not good!
- Click to edit the blank host name entries so there is some name or IP added. Anything but blank. I would type one of the following: "localhost", or "127.0.0.1" (loop back address) in the host name box. You can also assign IPv6 loopbacks or custom text names. But you would need to find your Host text file stored in your Windows folder on that box and manually add your loopback IP and the new name to that. A pain in the butt. So, just type one of the two items fpr host name only and click save. I would leave the IP as "all unassigned" though you can also reduce that to an IP. When you explicitly change host name to one of these entries, then that is required to now access the website in the browser. Localhost is the only address that will be accepted now for anyone accessing your website. But localhost will fail for everyone but you, as that points to the users local box. By making that explicit for host name, the server will no longer answer to its assigned network IP, name, or anything else but "localhost", no matter what IP they try. I prefer to use the 127.0.0.1 for host name as it now requires an explicit IP and overrides the all unassigned IPs and no text names will now work. But its up to you.
- Also do this change for the 8080 port entry. I assume you added a blank host name there too.
- Be sure you have no blank host name IP's entries in your bindings list for ports 80 or 8080 and the http or https protocols.
- Be sure to restart either your website instance or IIs.
You can test this works now by using your pc or another in your network and typing either your PCName:8080 or your locally assigned NetworkIP:8080 in your browser. Try those with port 80, too. None will work. You should get a 404 Not Found, where before someone could type either and see your website in-network from multiple computers. Dont ask me why Microsoft built it this way. This localhost system has been this way for over fifteen years in IIs. To me its always been a convoluted mess!
In the old days when we had lots of servers and websites in-network and wanted fast ways to access them and test them we would just use the pc names, ports, or bind IP's in IIs settings to custom names in host files.