Production security checklist

This page consolidates the security guidance spread across this guide into one checklist. Use it as a final review before LDAP integration code reaches production.

Transport

[ ] Every connection that sends real credentials uses ldaps:// or STARTTLS — never plain LDAP. See LDAP vs LDAPS.
[ ] TLS certificate validation is enabled (rejectUnauthorized is not disabled). See Production security with ldapjs.
[ ] The correct CA certificate is configured, rather than trusting the system default when it doesn't include your internal CA.

Input handling

[ ] Every filter value built from user or external input is escaped with escapeFilterValue before being embedded in a filter string. See LDAP injection.
[ ] Every DN component built from user input is escaped the same way. See Distinguished names.
[ ] Filters and DNs are validated before use, catching malformed input early rather than sending it to the directory. Prototype with the Filter Builder and DN Parser.

Credentials

[ ] Service account passwords are stored in environment variables or a secrets manager, never hardcoded or committed to source control.
[ ] The service account used for searches has least-privilege, read-only access — not a domain administrator or equivalent.
[ ] User-submitted passwords used for a verification bind are never logged, even at debug level.

Error handling

[ ] Bind failures are handled without leaking overly specific information to unauthenticated users (see the enumeration note in Authentication in Active Directory).
[ ] The LDAP client's error event is handled so a dropped connection can't crash the process. See Production security with ldapjs.
[ ] timeout and connectTimeout are set, so an unreachable directory can't hang a request indefinitely.

Operational

[ ] The application can tolerate one domain controller or directory replica being unavailable (multiple URLs configured, or DNS-based failover).
[ ] LDAP connectivity failures degrade gracefully rather than taking down unrelated functionality.

Tip

If every box above is checked, your integration covers the security guidance in this entire Security section. Revisit this list whenever you add a new LDAP-backed feature, not just at initial launch.

What's next

This is the final page in the core learning path. From here, explore the interactive LDAP tools, or jump back into any section as a reference — Getting Started, Node.js, Active Directory.