SuiteScript Security Considerations

Certain measures must be taken to ensure your SuiteScript script executes in a safe, secure manner. This includes the use of user credentials and executing scripts using a specific role, particularly when working with sensitive data. In general, you should follow these guidelines:

Security Consideration	Security Consideration Guidance
User passwords	Do not hard-code any passwords in scripts. Using plain text or other unencrypted user credentials is unsafe and can pose a security threat. Whenever possible, use Token-based Authentication (TBA) or OAuth2.0 to specify user credentials. Plaintext passwords can be used with SFTP, certificates, and other areas, however NetSuite always gives the customer the option to use encrypted credential (GUID) instead.
Script Deployment	Deploy scripts to run as administrator only if necessary to minimize security risk and to eliminate performance overhead. See Executing Scripts Using a Specific Role.
Script parameters	For security reasons, do not include confidential information in script parameters. Information saved in script parameters can be indexed by search engines and therefore be viewable by the public. This means, for example, that the information could be found in Google searches. For more information, see Creating Script Parameters Overview.
SuiteScript 2.x RESTlet Script Type	The URLS for accessing RESTlets are protected by TLS encryption. Only requests sent using TLS encryption are granted access. For more information, see Supported TLS Protocol and Cipher Suites.
SuiteScript 2.x Suitelet Script Type	Deploy Suitelets as “Available without Login” only if necessary, such as when there is no user context or to due to login performance overhead. See Setting Available Without Login.) When building custom UI objects outside of the standard UI, such as when building a custom mobile page using a Suitelet), you can use the N/auth Module to help users manage their credentials within the custom UI.
SuiteScript 2.x User Event Script Type	To prevent users from accessing sensitive information, such as password and credit card data, the following internal field IDs cannot be read in `beforeSubmit` entry point scripts for external role users: password password2 ccunumber (on the sales order record) ccsecuritycode (on the sales order record) External role users include shoppers, online form users and other anonymous users, customer center users, etc.
N/auth Module	Take extreme care when using the N/auth module to change an email or user password. Both the auth.changeEmail(options) and auth.changePassword(options) methods allow you to include a plaintext string for the password.
N/http Module and N/https Module	For security purposes, NetSuite blocks some headers from use in HTTP and HTTPS calls. For a list of blocked headers, see HTTP Header Information and HTTPS Header Information
N/https Module	Plaintext user credentials can be included in HTTPS request parameters or in the body. Using plain text or other unencrypted user credentials is unsafe and can pose a security threat. Whenever possible, use Token-based Authentication (TBA) or OAuth2.0 to specify user credentials.
N/query Module	When working with credit cards, you can retrieve only the encrypted version of the credit card number, at most. You may not be able to retrieve and credit card number data.

Security Consideration

Security Consideration Guidance

User passwords

Do not hard-code any passwords in scripts. Using plain text or other unencrypted user credentials is unsafe and can pose a security threat. Whenever possible, use Token-based Authentication (TBA) or OAuth2.0 to specify user credentials.
Plaintext passwords can be used with SFTP, certificates, and other areas, however NetSuite always gives the customer the option to use encrypted credential (GUID) instead.

Script Deployment

Deploy scripts to run as administrator only if necessary to minimize security risk and to eliminate performance overhead. See Executing Scripts Using a Specific Role.

Script parameters

For security reasons, do not include confidential information in script parameters. Information saved in script parameters can be indexed by search engines and therefore be viewable by the public. This means, for example, that the information could be found in Google searches. For more information, see Creating Script Parameters Overview.

SuiteScript 2.x RESTlet Script Type

The URLS for accessing RESTlets are protected by TLS encryption. Only requests sent using TLS encryption are granted access. For more information, see Supported TLS Protocol and Cipher Suites.

SuiteScript 2.x Suitelet Script Type

Deploy Suitelets as “Available without Login” only if necessary, such as when there is no user context or to due to login performance overhead. See Setting Available Without Login.)
When building custom UI objects outside of the standard UI, such as when building a custom mobile page using a Suitelet), you can use the N/auth Module to help users manage their credentials within the custom UI.

SuiteScript 2.x User Event Script Type

To prevent users from accessing sensitive information, such as password and credit card data, the following internal field IDs cannot be read in beforeSubmit entry point scripts for external role users:

password
password2
ccunumber (on the sales order record)
ccsecuritycode (on the sales order record)

External role users include shoppers, online form users and other anonymous users, customer center users, etc.

N/auth Module

Take extreme care when using the N/auth module to change an email or user password. Both the auth.changeEmail(options) and auth.changePassword(options) methods allow you to include a plaintext string for the password.

N/http Module and N/https Module

For security purposes, NetSuite blocks some headers from use in HTTP and HTTPS calls. For a list of blocked headers, see HTTP Header Information

and HTTPS Header Information

N/https Module

Plaintext user credentials can be included in HTTPS request parameters or in the body. Using plain text or other unencrypted user credentials is unsafe and can pose a security threat. Whenever possible, use Token-based Authentication (TBA) or OAuth2.0 to specify user credentials.

N/query Module

When working with credit cards, you can retrieve only the encrypted version of the credit card number, at most. You may not be able to retrieve and credit card number data.

SuiteScript Security Considerations

Related Support Articles

Related Topics