# WHATPORT(5280)

## NAME

port 5280 — XMPP over BOSH / HTTP — An XMPP server's HTTP side — BOSH and WebSocket endpoints for browser-based chat clients.

Protocol: TCP  
IANA registry

## DESCRIPTION

Registered with IANA in 2009 as xmpp-bosh, this is the HTTP port for Bidirectional-streams Over Synchronous HTTP (XEP-0124), which tunnels an XMPP session through long-polling HTTP requests for clients that cannot hold a raw TCP stream. Prosody uses 5280 as its default plain-HTTP port, serving /http-bind for BOSH and /xmpp-websocket, with 5281 as the HTTPS counterpart. On a scan it responds like a small web server, which is exactly what it is.

## EXPOSURE

**Expose with care.** Plain HTTP by default — session credentials and messages are cleartext unless you front it with TLS on 5281 or a reverse proxy.

## CHECK

```sh
curl -sS -o /dev/null -w '%{http_code}\n' http://TARGET:5280/http-bind/
```

## SEE ALSO

- spec — [XEP-0124 — Bidirectional-streams Over Synchronous HTTP (BOSH)](https://xmpp.org/extensions/xep-0124.html) (xmpp.org)
- docs — [Prosody — setting up BOSH](https://prosody.im/doc/setting_up_bosh) (prosody.im)
- iana — [IANA port registry — 5280 (xmpp-bosh)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5280) (iana.org)

---

HTML: <https://whatport.net/5280/> · JSON: <https://whatport.net/5280.json> · full dataset: <https://whatport.net/ports.json>