NetSuite Changelog
SuiteScriptSuiteScripteCommerceNew FeatureRelease Notes

Authentication and Authorization for SuiteScript Applications

Authentication and authorization differences between Suitelets, RESTlets, SSP applications, and Scriptable Carts enhance user access control.

·2 min read·View Oracle Docs

The authentication and authorization mechanisms for SuiteScript applications play a vital role in defining how different application types interact with users. Understanding these differences helps developers implement the appropriate security measures for their applications.

What Are the Different Authentication Options?

The following table outlines the authentication capabilities across Suitelets, RESTlets, SSP applications, and Scriptable Carts:

FeatureSuiteletRESTletSSP ApplicationScriptable Cart
Available Without LoginSupportedNot SupportedSupportedSupported
Recognized User (Cookies)Not SupportedNot SupportedSupportedSupported
ShopperNot SupportedNot SupportedSupportedSupported
User (Entity Record)SupportedSupportedSupportedSupported
Authentication MechanismJSessionIdJSessionId/nlAuthJSessionIdJSessionId
AudienceSupportedSupportedNot ApplicableNot Applicable
Execute As AdminSupportedNot SupportedNot SupportedNot Supported

Supported Mechanisms

  • JSessionId: This token is used to manage user sessions effectively across different types of applications, enabling secure and seamless user experiences.
  • nlAuth: Specific to RESTlets, providing an additional layer of authentication for API calls.

Who This Affects

Understanding these authentication methods primarily impacts:

  • Developers: Ensure the right security layers are implemented for web application development.
  • Administrators: Manage user permissions and access effectively across different application types.
  • Security Teams: Monitor and uphold application security standards and practices.

Key Takeaways

  • Different SuiteScript applications have varied authentication and authorization capabilities.
  • Each application type uses specific mechanisms that affect user experience and security.
  • Developers must choose the right application type based on the authentication requirements.

Source: This article is based on Oracle's official NetSuite documentation.

Frequently Asked Questions (4)

What authentication mechanism is specific to RESTlets in SuiteScript applications?
RESTlets use the nlAuth authentication mechanism, which provides an additional layer of security for API calls.
Can Suitelets be accessed without user login in SuiteScript applications?
Yes, Suitelets can be accessed without user login, as they support being available without login.
Are SSP Applications able to recognize users through cookies in NetSuite?
Yes, SSP Applications support user recognition through cookies, which aids in providing a personalized user experience.
Is the 'Execute As Admin' feature available for RESTlets in SuiteScript?
No, the 'Execute As Admin' feature is not supported for RESTlets in SuiteScript applications.
Source: Authentication and Authorization — Oracle NetSuite Help Center. This article was generated from official Oracle documentation and enriched with additional context and best practices.

Was this article helpful?

More in SuiteScript

View all SuiteScript articles →