In the Game

Browser Interface

An optional second-screen interface that opens in your own browser instead of the sidebar drawn over the game. Off by default. The sidebar is not deprecated and is not going away.

Turning it on

1
Open the sidebar from the KSP toolbar
Go to the Settings panel.
2
Switch on the browser interface
The setting is saved immediately and persists across restarts.
3
Click the toolbar button again
Your default browser opens on the interface. A small in-game panel also appears showing the address, with buttons to reopen it, copy the URL, or switch back to the sidebar.

Which one should you use?

On a single monitor the sidebar is genuinely better: alt-tabbing out of KSP to read a contract is worse than a panel drawn over the game. The browser interface is built for people with a second screen, and that is the only case where it wins.

How it works

The add-on runs a small HTTP server inside the KSP process, bound to 127.0.0.1 on a port chosen at random each session, serving a static page from the add-on’s own folder. The page talks to that server, which relays requests upstream on its behalf.

That relay is the point of the design. The add-on attaches your session token in C# before forwarding, so the token never exists in the browser page at all. There is nothing in the page worth stealing.

`Bound to loopback only` 127.0.0.1	Always. There is no setting that would expose it to your network or the internet.
`Random port per session` defence in depth only	A new ephemeral port each time KSP starts. Treated as obscurity rather than security, because a local process can scan every port in under a second.
`One-time launch link` 15 second lifetime	The URL handed to your browser carries a nonce that is single use and expires in fifteen seconds. A bookmarked or shared URL does not work, which is deliberate.
`Session cookie` HttpOnly, SameSite=Strict	A random value proving the page is the one KSP just opened, paired with a CSRF token in a custom header. Never sent to any website, and gone when the browser closes.
`Host and origin checks` DNS rebinding defence	Exact host match, plus origin and fetch-site checks, so a page on another site cannot reach the bridge even from your own machine.

One residual risk, documented rather than hidden

Opening a URL hands it to your operating system, which on Linux means it is briefly visible in the process list, nonce included. The fifteen second lifetime, the single use and the browser consuming it in a fraction of a second make that window narrow, and a hostile local user with access to your account could already read the session token off disk.

What stays in the game

Most of the interface is there: your profile, notifications, weekly missions, the contract inbox with its actions, contract and auction creation, rescue contracts, craft installs, quicksend, flag import and settings.

Some things stay in the game permanently, because a browser tab is the wrong place for them:

`Submitting a contract` in game	It waits for physics to settle, measures live distance between vessels and captures the scene with the game's UI hidden, all of which need KSP focused. The browser's submit button raises the real window in game instead.
`Notification popups` in game	They have to appear over the game while you are flying, not on another monitor.
`Milestone photo prompts` in game	A short, one-tap capture that fires mid-flight.
`Linking and consent` in game	Linking needs a code typed in KSP and an approval in Discord. Consent is the gate everything else waits on, and the recovery path if the browser never opens.
`Device verification` in game	A security prompt about this machine. Answering it in a background tab would defeat its purpose.
`Filing a bug report` in game	The attachment that makes a KSP bug diagnosable is your KSP.log, which can only be read from inside the running game.

When the browser does not open

Handing a URL to your operating system can fail quietly. That is why the in-game panel always appears too: it shows the address and has a copy button, so you can always paste it into a browser yourself.

Known causes

Steam overlay. It may capture the link and open it in Steam’s own built-in browser, which is too old to run the interface. Copy the URL into a real browser instead.
Flatpak, Snap or Proton on Linux. xdg-open may not be reachable from inside the sandbox. Copy the URL.
Exclusive fullscreen. Alt-tabbing out of exclusive fullscreen has a long history of black screens in KSP, especially on Linux and older NVIDIA drivers. Switch KSP to borderless windowed if you plan to use a second screen.

If the interface loads but says the session expired, open it again from the toolbar. The launch link is single use and short lived, so an old one will never work.

Antivirus and firewall prompts

A game that opens a listening socket and launches a browser is a mild heuristic trigger for some endpoint security products, and Windows may show a firewall prompt. The socket is loopback only, so you can decline any request to allow it through the firewall and the interface will still work. Nothing here needs to cross your network.

Two KSP installs at once

Each running copy of KSP binds its own port, so two installs give you two independent interfaces at two addresses. They do not share a session and cannot interfere with each other.

For what the sidebar itself does, see The Sidebar.

PreviousMod Settings File NextArchitecture