Skip to main content
protocols.pageprotocols.page
8081

Port 8081 – HTTP Alternate / Kafka REST

TCP

Port 8081 is a common secondary HTTP development port and the default for Confluent Schema Registry and Kafka REST Proxy. Like 8080, it is used when port 80 is unavailable. Spring Boot and many Java frameworks default to 8080 first, then 8081 for a second service.

Port Number

8081

Protocol

TCP

Service

HTTP Alternative / Kafka REST Proxy

Range

IANA Registered (1024–49151)

Description

Port 8081 is widely used as a secondary HTTP service port. The Confluent Schema Registry listens on 8081 by default, providing Avro and Protobuf schema management for Kafka. The Confluent REST Proxy also uses 8081. In development, teams commonly run API services on 8080 and admin/metrics endpoints on 8081.

Security risks

  • 1CVE-2023-0762: Confluent Schema Registry SSRF – unauthenticated attacker could make Schema Registry fetch from internal URLs via schema references (fixed 7.3.3)
  • 2Schema Registry default install has no authentication – any network-adjacent client can register, modify, or delete schemas, breaking downstream consumers
  • 3Compatibility level changes (e.g., BACKWARD to NONE) allow breaking schema evolution that crashes consumers on next deployment
  • 4Schema content may reveal internal data models, PII field names, and business logic to unauthorized viewers
  • 5REST Proxy on 8081 provides full Kafka produce/consume without requiring Kafka client credentials, bypassing broker-level ACLs

Firewall guidance

If running Schema Registry: restrict port 8081 to Kafka client machines and CI/CD pipelines (which register schemas on deploy). Block from internet. Enable authentication via schema.registry.basic.auth.credentials.source in clients. If just a dev HTTP server: bind to 127.0.0.1 only.

Diagnosis commands

List all registered schema subjects (Schema Registry)

shell
curl -s http://localhost:8081/subjects | jq .

Fetch schema by global ID

shell
curl -s http://localhost:8081/schemas/ids/1 | jq .schema

Check global compatibility level (BACKWARD, FORWARD, FULL, NONE)

shell
curl -s http://localhost:8081/config | jq .

Identify which process is bound to port 8081

shell
lsof -i :8081 | grep LISTEN

Usage examples

Port 8081 – HTTP Alternate / Kafka REST
shell
curl http://localhost:8081/subjects
curl http://localhost:8081/schemas/ids/1

Common services on this port

Confluent Schema RegistryConfluent REST ProxySpring Boot secondaryMcRouterTiDB Status

Related ports

8080

HTTP alternate (primary dev port)

8082

Confluent REST Proxy (alternate)

8083

Confluent Connect REST API

9092

Kafka broker (plaintext)

History

Port 8081 has no single official assignment – it evolved as the 'next port after 8080' convention. Confluent adopted it for Schema Registry when they built the Kafka platform (2014-2015). The Schema Registry provides Avro, Protobuf, and JSON Schema storage with compatibility enforcement. Many development frameworks use 8081 as a secondary port (admin, metrics, or a second service in the same project).

FAQ

What is the Schema Registry and why does it need its own port?

Schema Registry stores and validates message schemas (Avro, Protobuf, JSON Schema) that Kafka producers and consumers agree on. It runs as a separate service (port 8081) because it needs to be highly available independent of any single Kafka client. Producers check compatibility before sending; consumers fetch schemas to deserialize. Without it, schema evolution breaks consumers silently.

How do I secure Confluent Schema Registry?

Enable HTTPS (ssl.keystore.location, ssl.truststore.location in schema-registry.properties). Add RBAC via Confluent Platform's MDS (schema.registry.security.plugin.class). For basic auth: set authentication.method=BASIC and provide a JAAS config. In production, always use confluent.schema.registry.auth with per-subject ACLs.