Neo4j Bolt and HTTP connectors: does disabling authentication expose both protocols on all interfaces?

Direct answer

No. Setting dbms.security.auth_enabled=false only removes the credential check; it does **not** alter the listen address of any connector. The Bolt and HTTP connectors each have independent bind‑address settings, so binding Bolt to a specific interface does not cause the HTTP connector to inherit that setting.

Confirmed facts

• Authentication and network binding are orthogonal configuration dimensions in Neo4j.
• Each connector defines its own listen address: server.http.listen_address (5.x) or dbms.connector.http.listen_address (3.x/4.x). The Bolt connector uses the analogous server.bolt.listen_address / dbms.connector.bolt.listen_address.
• Changing one connector’s address never affects the other; the HTTP connector retains whatever address its own setting (or default) specifies.
• In the official Docker image and many package defaults, the HTTP connector’s default listen address is 0.0.0.0:7474 unless overridden.
• With authentication disabled, anyone who can reach the HTTP port can use the transactional HTTP endpoint and Neo4j Browser without credentials, making an unrestricted 0.0.0.0 bind a real exposure.

Likely explanation / considerations

Administrators sometimes tighten only the Bolt address assuming it will “protect” the HTTP endpoint. Because the connectors are independent, the HTTP listener remains exposed unless its address is explicitly restricted or the connector is disabled.

Steps to ensure the HTTP connector is not publicly reachable when auth is off

1. Determine your Neo4j version (the setting names differ between 3.x/4.x and 5.x).
2. Edit neo4j.conf (or the appropriate config override) and set the HTTP listen address to a loopback interface, e.g.:
   

   # Neo4j 5.x
   server.http.listen_address=127.0.0.1:7474
   # Neo4j 3.x/4.x
   dbms.connector.http.listen_address=127.0.0.1:7474

3. Alternatively, disable the HTTP connector entirely if no tooling requires it:
   

   # Neo4j 5.x
   server.http.enabled=false
   # Neo4j 3.x/4.x
   dbms.connector.http.enabled=false

4. Save the file and restart Neo4j.
5. Verify the bind address:
   
   • Inside the container/host run ss -tlnp or netstat -tlnp and confirm port 7474 is bound to 127.0.0.1 (or not listening at all if disabled).
   • Check the startup log or run SHOW SETTINGS (5.x) to see the resolved server.http.listen_address value.
6. From a separate machine, attempt an unauthenticated HTTP request to the transactional endpoint (e.g., POST http://<host>:7474/db/neo4j/tx/commit) and verify it is refused or unreachable.

Missing diagnostic detail

To give a precise configuration snippet, please confirm which Neo4j major version you are running (3.x, 4.x, or 5.x), as the setting names differ between these releases.