SuiteScript Security Considerations

User passwords

• Don't hard-code any passwords in scripts. Using plain text or other unencrypted user credentials is unsafe and can pose a security threat. Whenever possible, use Token-based Authentication (TBA) or OAuth2.0 to specify user credentials.

• Plaintext passwords can be used with SFTP, certificates, and other areas, however NetSuite always gives the customer the option to use encrypted credential (GUID) instead.

Script Deployment

Deploy scripts to run as administrator only if necessary to reduce security risks and performance issues. See Executing Scripts Using a Specific Role.

Script parameters

For security reasons, don't include confidential information in script parameters. Information saved in script parameters can be indexed by search engines and therefore be viewable by the public. This means, for example, that the information could be found in Google searches. For more information, see Creating Script Parameters Overview.

SuiteScript 2.x RESTlet Script Type

The URLS for accessing RESTlets are protected by TLS encryption. Only requests sent using TLS encryption are granted access. For more information, see Supported TLS Protocol and Cipher Suites.

SuiteScript 2.x Suitelet Script Type

• Deploy Suitelets as “Available without Login” only if necessary, such as when there is no user context or due to login performance overhead. See Setting Available Without Login.)

• When building custom UI objects outside of the standard UI, such as when building a custom mobile page using a Suitelet, you can use the N/auth Module to help users manage their credentials within the custom UI.

SuiteScript 2.x User Event Script Type

To prevent users from accessing sensitive information, such as password and credit card data, the following internal field IDs cannot be read in beforeSubmit entry point scripts for external role users:

• password

• password2

• ccunumber (on the sales order record)

• ccsecuritycode (on the sales order record)

External role users include shoppers, online form users and other anonymous users, customer center users, etc.

N/auth Module

Be extremely careful when using the N/auth module to change an email or user password. Both the auth.changeEmail(options) and auth.changePassword(options) methods allow you to include a plaintext string for the password.

N/http Module and N/https Module

For security purposes, NetSuite blocks some headers from use in HTTP and HTTPS calls. For a list of blocked headers, see HTTP Header Information

and HTTPS Header Information

N/https Module

Plaintext user credentials can be included in HTTPS request parameters or in the body. Using plain text or other unencrypted user credentials is unsafe and can pose a security threat. Whenever possible, use Token-based Authentication (TBA) or OAuth2.0 to specify user credentials.

N/query Module

When working with credit cards, you can retrieve only the encrypted version of the credit card number, at most. You may not be able to retrieve and credit card number data.

Content from external sources

Use Subresource Integrity when you include content from external sources in Inline HTML fields. For more information, see Subresource Integrity.