Hey all, happy New Years and all that. I'm having an issue that I'm hoping to get some advice on. There is a script being run in a client's environment that is making an https call, and in the header they are hardcoding a user email and user password, which is a bad idea for a multitude of reasons. Is there some way I can circumvent this? I've considered trying to use the N/runtime module to pull the current user's credentials, but I couldn't see a clear way to make that happen. I also wasn't sure if there was some other way to set up the https header to not require a user's password. Any advice would be appreciated!

what sort of script?

It's an M/R script. It looks like it's going through a list of Cases, making an https.get() call to each Case to get the contents, then creating a HTML file and saving it to the File Cabinet. I'm trying to determine if I even need to make an https call, or if I could just load each record separately. The script is kind of a mess and I just jumped into it today, so I'm still not 100% clear on everything just yet

um, that sounds extra weird

Agreed 😂

but if they really wanted half working html pages, thats a way to do it

does netsuite allow grabbing the password value of a user?

no

i didn't think so

basically nobody should

i considered just creating a new random password every time the script ran and sending that with the header, but i believe you can only change the password for the current user

fwiw, at least that username/password is not plaintext over the wire - https ensures that

That's true, it could be worse