Allow Site to Be Framed: Enhancing Security in NetSuite

TL;DR Opening

The Allow Site to Be Framed feature in NetSuite enables control over whether your web pages can be embedded in an HTML iframe. This setting is crucial for managing content security and ensuring that user sessions remain intact while interacting with embedded content.

What is the Allow Site to Be Framed Feature?

The Allow Site to Be Framed setting adds HTTP headers that determine the conditions under which your web pages can be framed. While it facilitates embedding, it's important to be cautious with this feature due to modern cookie management practices that can affect site functionality.

Options for Allow Framing

The feature provides three configuration options:

• Disallow Framing: This is the default setting that allows framing only by the exact same domain/origin.
• Allow Framing: This option permits framing by any domain/origin.
• Allow Framing Custom: Here, you can specify a list of authorized domains/origins that are allowed to frame your web pages.

Important Note: Although enabling framing can help render pages, be aware that critical features like login, cart, and checkout may not function properly when the parent domain of the iframe differs from your SuiteCommerce domain.

How to Configure Framing Settings

To configure the Allow Site to Be Framed settings, follow these steps:

1. Navigate to Advanced > Security in the NetSuite UI.
2. Locate the setting for Allow Site to Be Framed.
3. Choose your desired option: Disallow, Allow, or Custom.
4. If opting for Allow Framing Custom, populate the allowed domains list appropriately.

Allow Site to Be Framed By

The Allow Site to Be Framed By array provides additional configuration to choose which origins are permitted to display pages in a frame. By default, it includes the SAMEORIGIN directive to allow framing by your own domain.

Properties:

• ID: security.allowFramingBy
• UI location: Advanced > Security
• JSON file: SecurityHeaders.json

Adding Headers to SSP Responses

Furthermore, you can enhance your security setup by adding HTTP headers to your Servlet-Specific Protocol (SSP) responses. Here are two critical properties involved:

• Name: Define the HTTPS header name (case insensitive).
• Value: Specify the corresponding value for the HTTPS header.

Additional Information

To learn more about managing secure communication, refer to the HTTPS header documentation. Ensuring that your HTTPS calls comply with best security practices is paramount, especially in today’s security-centric online environment.

Who This Affects

• Developers: When implementing framing options and understanding cookie management.
• Administrators: Responsible for configuring security settings in the NetSuite dashboard.

Key Takeaways

• The Allow Site to Be Framed feature controls iframe embedding for web pages.
• Be cautious as modern cookie practices may hinder functionality in iframes.
• Configuration options include disallowing, allowing, or customizing allowed domains.

Source: This article is based on Oracle's official NetSuite documentation.