Port 8080 – HTTP Alternate

TCP

Port 8080 is the most common alternative HTTP port used for development servers, proxies, and services that can't bind to port 80 (which requires root on Linux). Docker, Tomcat, Jenkins, and many development tools default to port 8080.

Port Number

8080

Protocol

TCP

Service

HTTP Alternative Port

Range

IANA Registered (1024–49151)

Description

Port 8080 is an unofficial HTTP port used widely in development and as an alternative to port 80. On Linux, ports below 1024 require root or CAP_NET_BIND_SERVICE capability – developers use 8080 to run HTTP servers without elevated privileges. Nginx and Apache proxies often forward from 80 to 8080.

Security risks

1Development server exposure: services on 8080 are often development instances with debug mode enabled, verbose error pages (stack traces with source paths), and no authentication. Never expose 8080 to the internet without explicit access control.
2Proxy misconfiguration: reverse proxies forwarding 80->8080 may expose the backend directly if 8080 is also reachable. An attacker bypasses WAF/auth rules on port 80 by connecting to 8080 directly. Bind backend to 127.0.0.1:8080.
3Admin console exposure: Tomcat Manager (/manager/html), Jenkins dashboard, and Spring Boot Actuator endpoints on 8080 provide administrative access. Restrict with IP allowlists and strong authentication.

Firewall guidance

Port 8080 should not be directly accessible from the internet in production. Use a reverse proxy (Nginx/Caddy on 443) in front that handles TLS and forwards to 8080 on localhost. In Kubernetes, pods expose 8080 internally but Services/Ingress terminate TLS on 443. Development instances must bind to 127.0.0.1:8080 explicitly.

Diagnosis commands

Basic HTTP check – verify service is responding

shell

curl -I http://localhost:8080/

Show which process owns port 8080

shell

ss -tnlp sport = :8080

Remote service detection – identifies Tomcat, Jenkins, etc. by banner

shell

nmap -sV -p 8080 target

Check Spring Boot health endpoint (common on 8080)

shell

curl http://host:8080/actuator/health

Usage examples

Port 8080 – HTTP Alternate

shell

python -m http.server 8080
npm start # defaults to :8080
curl http://localhost:8080

Common services on this port

Apache TomcatJenkinsDocker containersNginx (upstream)Spring BootNode.jsWildFly/JBossKubernetes pods

Related ports

HTTP standard (requires root)

443

HTTPS (production)

8443

HTTPS alternate

8000

HTTP dev (Django, Python)

History

Port 8080 became the de facto HTTP alternate in the 1990s when Apache Tomcat chose it as default (port 80 required root). The convention spread to nearly all Java application servers and eventually to general development tooling. IANA registered it as http-alt.

FAQ

Why 8080 and not just port 80?

On Unix/Linux, binding to ports below 1024 requires root privileges (or CAP_NET_BIND_SERVICE). Developers running as normal users cannot bind to 80 – 8080 is the convention for 'HTTP without root'. In production, a root-owned reverse proxy on 80/443 forwards to the app on 8080.

Is port 8080 less secure than port 80?

The port number itself has no security implications – it is the service configuration that matters. The risk is that 8080 services are more likely to be development instances (debug mode, no auth) accidentally exposed, while port 80 services are more likely to be production-hardened.