Skip to main content
protocols.pageprotocols.page
9080

Port 9080 – WebSphere HTTP

TCP

Port 9080 is the IBM WebSphere Application Server default HTTP port for deployed applications. WebSphere serves Java EE applications on port 9080 (HTTP) and 9443 (HTTPS). In production, front WebSphere with IBM HTTP Server or a load balancer on ports 80/443 and restrict direct access to ports 9080/9443.

Port Number

9080

Protocol

TCP

Service

IBM WebSphere Application HTTP

Range

IANA Registered (1024–49151)

Description

WebSphere serves deployed Java EE applications on port 9080 for HTTP traffic. The HTTPS equivalent is port 9443. These ports handle end-user application requests – servlets, JSPs, JAX-RS APIs, and web services. Direct exposure of port 9080 to the internet is discouraged. Production WebSphere deployments use IBM HTTP Server (IHS, based on Apache) or a hardware load balancer as the front-end on ports 80/443. The web server plugin routes requests to WebSphere on port 9080 internally. This architecture provides: TLS termination, static content serving, connection pooling, and isolation of the application server from direct internet traffic.

Security risks

  • 1Direct internet exposure bypasses web server protections: IBM HTTP Server (IHS) provides mod_security, request filtering, connection limits, and static content serving. Direct access to 9080 skips all of these layers.
  • 2CVE-2021-26296: WebSphere application framework vulnerabilities (JSF ViewState deserialization, EL injection) are directly exploitable when port 9080 is reachable – IHS URL filtering would block malformed requests.
  • 3Server version disclosure: WebSphere default error pages on port 9080 reveal exact version, fix pack level, and JVM version – precise information for targeted exploit selection.
  • 4Application deployment artifacts: /snoop, /hitcount, /ivt (Installation Verification Test) servlets often remain deployed in production, leaking server internals (HTTP headers, class paths, system properties).
  • 5No TLS: port 9080 is plaintext HTTP. Application data, session cookies, and any form submissions travel unencrypted between client and server.

Firewall guidance

Never expose port 9080 directly to the internet. Front with IBM HTTP Server (IHS) or a load balancer (F5, HAProxy, AWS ALB) on ports 80/443. The IHS plugin (plugin-cfg.xml) routes requests to WebSphere on port 9080 via internal network. Bind WebSphere HTTP transport to localhost or private interface only. In cloud deployments, use internal-only target groups with health checks on 9080.

Diagnosis commands

Check for version disclosure headers (should be suppressed in production)

shell
curl -sI http://washost:9080/ | grep -i 'server\|x-powered'

Test if diagnostic servlets are still deployed (should return 404)

shell
curl -s http://washost:9080/snoop 2>&1 | head -5

Verify WebSphere is listening and check bind address (should be 127.0.0.1 or private IP)

shell
ss -tnlp sport = :9080

Enumerate accessible paths on the WebSphere HTTP port

shell
nmap -sV -p 9080 --script http-enum target

Usage examples

Port 9080 – WebSphere HTTP
shell
curl http://washost:9080/myapp/
Plugin configuration: ServerCluster -> server port 9080
wsadmin: AdminConfig.modify(transport, port=9080)

Common services on this port

IBM WebSphere Application ServerIBM WebSphere LibertyIBM HTTP Server (IHS) plugin backend

Related ports

9443

WebSphere Application HTTPS

9043

WebSphere Admin HTTPS

80

IBM HTTP Server / LB frontend

443

IBM HTTP Server / LB frontend (TLS)

History

Port 9080 became the WebSphere application HTTP default in WebSphere 4.x (2001) when IBM separated admin ports (9060/9043) from application ports (9080/9443). The port offset design (base port + offset per server instance) allows multiple WebSphere instances on one host. IBM HTTP Server (based on Apache httpd) has been the recommended frontend since WebSphere 3.x, using the WebSphere plugin module for request routing.

FAQ

Why not serve directly from port 9080 if I have no other web server?

WebSphere's HTTP transport is designed for application serving, not edge traffic. It lacks: connection-level rate limiting, request size limits (DoS protection), efficient static file serving, and the hardening a purpose-built web server provides. IHS/Nginx/HAProxy on 80/443 → WebSphere on 9080 is the production architecture. Even for small deployments, Nginx as reverse proxy adds TLS termination and basic protection with minimal overhead.

How do I configure the IHS plugin for port 9080?

Generate plugin-cfg.xml from WebSphere admin console: Environment > Update global web server plug-in configuration. The file maps URI patterns to backend servers on port 9080. Install in IHS: LoadModule was_ap24_module /path/mod_was_ap24_module.so, WebSpherePluginConfig /path/plugin-cfg.xml. IHS listens on 80/443 and proxies to WebSphere on 9080 internally.