Building Enterprise JavaScript Applications

Privileged ports

Apart from being bad for developer experience, there's a more important reason why our API should be served on a privileged port: when the consumers of our API send us their data, they need to trust that the information they sent is only handled by processes that were initiated by the server administrator (often root), and not by some malicious party.

Let's suppose a malicious party somehow managed to breach our server and got access to an ordinary user account. If we had set our API port to a non-privileged port, then that malicious user could spawn a modified, rogue API service that binds to that port, and use it to extract sensitive information, such as user passwords. Now, any information sent by the client to this port ...