Local File Server

About

The Local File Server extension enables web sites to link to local files via "http://localhost/" URLs. For security reasons, Chrome blocks "file://" URLs to local files in remote web pages. Some web services, like for instance Gmail, don't even render such URLs. Though, there are circumstances where links to local files are secure and desirable. For example, a local process, like a backup job, may want to send execution logs via email that contain links to local files. If the generated email includes "file://" URLs and the email is read in Gmail, the URLs won't even be rendered and even if they were rendered, Chrome (and most other browsers) would block them. Thanks to the Local File Server extension, the process can instead include "http://localhost/" URLs. These will be rendered in all email clients, they won't be blocked by any browser, and the extension will redirect them to the desired local file (provided the URLs are accessed from the machine where the files live).

The syntax for local file URLs is http://localhost/file.html?path=<file-path> where <file-path> is the absolute path to the desired local file. No "file://" prefix is allowed in the path. Forward slashes (/) (not backslashes (\)) must be used as directory separators (even on Windows systems). All paths must start with a forward slash (/). Here are a few working examples for different systems:

- Linux: http://localhost/file.html?path=/home/ links to the /home/ directory.
- macOS: http://localhost/file.html?path=/System/ links to the /System/ directory.
- Windows: http://localhost/file.html?path=/C:/Windows/ links to the C:\Windows\ directory.

Malicious third parties could abuse http://localhost/ URLs to access your local files. For that reason, when a http://localhost/file.html?path=<file-path> URL is clicked, the Local File Server extension doesn't directly open the desired file. Instead, it renders a page that displays a link with a "file://<file-path>" URL and a warning to only click on it if one was brought there via a trusted party. If one clicks on the link, the file designated by <file-path> is opened (provided the link is accessed from the machine where the file lives).

The extension allows the creation of direct local file URLs that avoid the need to click twice and immediately open the designated file. Their syntax is http://localhost/file.html?path=<file-path>&access-key=<access-key> where <access-key> is the access key stored in the Local File Server extension. When the extension is installed, a cryptographically secure access key is generated. It can be viewed and changed on the extension's options page. The key must be kept secret to prevent malicious third parties from being able to craft valid direct local file URLs. The key should only be shared with trusted parties that need to create direct local file URLs.

If the access key is ever leaked, set a new one in the extension (via it's option page). Old direct URLs will still work but instead of directly opening the linked files, they will render the same page as URLs with no access key and thus require a second click to actually open the designated file.

For any questions, comments or bug reports, please contact me via the developer email listed below or use the tools available in the Support section below.