A common recommendation as part of web server security is to run the server daemon as an unprivileged user (e.g.: nobody) so that exploits executing arbitrary code may have less unwanted effects. However, since port 80 is a "privileged port" the server must be started as an administrator (e.g.: root) and drop privileges in request serving children.
However, I haven't found any sources that discuss the security implications of having root involved at all when running an origin server on an unprivileged port that is behind a reverse proxy.
Since the port is not privileged the origin server doesn't need to be root to bind. Are there security reasons to start the origin server as root? Why not start the server as the unprivileged user to begin with?
Assume nearly identical configurations where the only difference is that in instance A the origin server is started as root and then drops privileges while instance B is started as the unprivileged user.