Ports: the worst good idea of the internet
The internet builds on 2 overwhelmingly dominant protocols: TCP and UDP. While technically unrelated, the 2 protocols share a common concept: ports.
The main issue with ports: there are only 65535 of them, some of them are standardized, so they form a very precious and restricted namespace.
While a good idea at first, and a cheap way to achieve their goal, ports become a problem on modern architectures: local ports !
Local services
Local services are a plague, but we're stuck with them, and they won't go away soon. Worse, they tend to multiply, especially with local web-based software (electron, you are the main offender).
So it starts all good, your first service uses 8080, then a 8008, then 8001, then 5633, then you get tired and put a random one on 52134, ...
That doesn't scale.
One day or another, you will have a collision, and you will need to do manual configuration changes.
And it's not the only issue, security being another. Unix is an open system: users should be fully isolated, but ports are common to all users with no access control.
The real solution
Use UNIX sockets. Never use ports.
Why
- Secure: file access control just works.
- The namespace is much bigger: name the socket after your service and you're already good, reduces name conflicts.
- Self-documenting: Named sockets give an immediate look at what's behind.
How
- Most web frameworks support listening on unix sockets. If they don't: do not use such a flaky framework.
- nginx supports reverse-proxying to unix sockets.
- HTTP/HTTPS just works the same on unix sockets, just listen on one instead of listening on a port.
Sorry Windows users. Use a real OS.
To web service developers
Please, PLEASE make clean services that can listen on unix sockets. You can make it optional, but please don't close the door to sysops that care.
While we're at it
Make web services that support being hosted on relative paths. The web is inherently relative by nature.
Whether your app is hosted on https://myapp.com/ or http://common.com/sub/path/myapp, it shouldn't care. It shouldn't even be a configuration: just detect at runtime.