Yup that’s the type of thing we do with Lantern. In particular we:

1) Bind to a random port

2) Require a securely random base path for all requests. Anything without that path is rejected.

The backend just opens the browser at the random port and base path.