Skip to main content
protocols.pageprotocols.page
8280

Port 8280 – WSO2 HTTP

TCP

Port 8280 is the WSO2 API Manager and Enterprise Service Bus HTTP transport port – the unencrypted equivalent of port 8243. In production, redirect all port 8280 traffic to HTTPS (8243). Some internal microservice-to-gateway communication uses port 8280 when TLS termination happens at the load balancer.

Port Number

8280

Protocol

TCP

Service

WSO2 API Manager / ESB HTTP

Range

IANA Registered (1024–49151)

Description

WSO2 serves HTTP pass-through transport on port 8280. This is the unencrypted API gateway endpoint. In production deployments, port 8280 should either redirect to HTTPS (8243) or be used only for internal service-to-service communication behind a TLS-terminating load balancer. When WSO2 sits behind an AWS ALB or Nginx with TLS termination, internal traffic from the load balancer to WSO2 may use port 8280 (HTTP) since encryption is handled at the edge. Ensure the X-Forwarded-Proto header is respected so WSO2 generates correct HTTPS URLs in responses.

Security risks

  • 1Cleartext API traffic: port 8280 transmits OAuth tokens, API keys, request/response bodies, and client credentials in plaintext. Any network observer captures full API payloads including authentication headers.
  • 2SSRF via API definitions: WSO2 gateway on 8280 fetches backend URLs defined in API configurations. Malicious API definitions pointing to internal services (metadata endpoints, admin consoles) enable server-side request forgery through the gateway.
  • 3Same CVEs as 8243: CVE-2022-29464 (file upload RCE) affects both HTTP and HTTPS transports. The /fileupload path is reachable on port 8280 as well – patching only the HTTPS port leaves the HTTP port exploitable.

Firewall guidance

In production: either block port 8280 entirely (if all traffic comes via HTTPS 8243) or configure WSO2 to redirect all 8280 traffic to 8243. If used behind a TLS-terminating load balancer, restrict 8280 to only the load balancer's IP. Never expose port 8280 directly to the internet.

Diagnosis commands

Check if port 8280 serves content (should redirect to HTTPS) or is blocked

shell
curl -I http://gateway:8280/

Verify WSO2 is listening and which process owns port 8280

shell
ss -tnlp sport = :8280

Check response headers for security settings (HSTS, X-Frame-Options)

shell
nmap -p 8280 --script http-headers target

Usage examples

Port 8280 – WSO2 HTTP
shell
curl http://gateway:8280/services/echo
wso2am: <transportReceiver name='http' port='8280'/>
iptables -A PREROUTING -p tcp --dport 8280 -j REDIRECT --to-port 8243

Common services on this port

WSO2 API ManagerWSO2 Enterprise IntegratorWSO2 Micro Integrator

Related ports

8243

WSO2 HTTPS gateway (encrypted)

9443

WSO2 Management Console

80

HTTP standard (similar redirect pattern)

History

Port 8280 was chosen as the HTTP pass-through transport counterpart to HTTPS port 8243 in WSO2's architecture. The separation follows the pattern of 80/443 – HTTP for legacy/redirect, HTTPS for actual traffic. WSO2's Synapse/Axis2 transport layer handles both ports via the PassThroughHttpListener.

FAQ

Can I disable port 8280 entirely?

Yes. In deployment.toml: [transport.http] listener.enable = false. Or remove the HTTP transport receiver from axis2.xml. This forces all traffic to HTTPS (8243). Ensure no internal services depend on HTTP before disabling.