am I allowed to use a secret, from the secrets man...
# suitescriptd
dbaghdanov
09/15/2021, 9:54 PMam I allowed to use a secret, from the secrets manager in a https post body?
Copy code
define(["N/runtime", "N/https"],
(runtime, https) => {
const get = (requestParams) => {
let secureString = https.createSecureString({
input: '{custsecret_my_custom_secret}' // <<- another thread here suggested this format with the '{secret_id}'
});
let body = {
test: 'test',
secret: '{'+secureString+'}',
, key1: "custsecret_my_custom_secret"
, key2: 'custsecret_my_custom_secret'
, key3: '{custsecret_my_custom_secret}'
};
let response = <http://https.post|https.post>({
body: JSON.stringify(body),
url: "<https://my.domain.com/v1/endpoint>",
credentials: ['custsecret_my_custom_secret'], // <<- i've also tried wrapping in {} too
headers: {
Authorization: "Basic abcdefghijklmnopqrstuvwzyz=",
'Content-Type': "application/json",
Accept: '*/*'
}
});
}}); Copy code
[
{
"test": "test",
"secret": "{
https.SecureString
}",
"key1": "custsecret_my_custom_secret",
"key2": "custsecret_my_custom_secret",
"key3": "{
custsecret_my_custom_secret
}"
}
]b
battk
09/15/2021, 9:56 PMkey3 is the closest to being correct
battk
09/15/2021, 9:57 PMthough your server looks like its receiving it wrong, there shouldnt be new lines in that string
d
dbaghdanov
09/15/2021, 9:57 PMyeah, so I thought that https module would replace the value in the body
dbaghdanov
09/15/2021, 9:59 PMin the netsuite docs it says on
https.SecureStringAn https.SecureString is returned by https.createSecureString(options), SecureString.appendString(options), and SecureString.appendSecureString(options). It can also be used as the options.credentials parameter in a call to https.request(options).
b
battk
09/15/2021, 9:59 PMyour secure string is being destroyed in your code
battk
09/15/2021, 9:59 PMits an object converted to a string
d
dbaghdanov
09/15/2021, 9:59 PMit doesn't specifically call out https.post(options), was hoping that was just bad docs
b
battk
09/15/2021, 10:00 PMwhich means it isnt a secure string anymore
d
dbaghdanov
09/15/2021, 10:00 PMis it this line?
Copy code
secret: '{'+secureString+'}',b
battk
09/15/2021, 10:00 PMa string plus an object is a string
battk
09/15/2021, 10:00 PMand a string is not a secure string
d
dbaghdanov
09/15/2021, 10:03 PMI took that line out, but still no dice
b
battk
09/15/2021, 10:05 PMnormal advice
battk
09/15/2021, 10:06 PMpost to https://httpbin.org/post
battk
09/15/2021, 10:06 PMlog the response body
d
dbaghdanov
09/15/2021, 10:10 PM{ "args": {}, "data": "{\\"test\\":\\"test\\",\\"key1\\":\\"custsecret_my_custom_secret\\",\\"key2\\":\\"custsecret_my_custom_secret\\",\\"key3\\":\\"{custsecret_my_custom_secret}\\"}", "files": {}, "form": {}, "headers": { "Accept": "*/*", "Accept-Encoding": "gzip, deflate", "Authorization": "Basic abcdefghijklmnopqrstuvwzyz=", "Content-Length": "143", "Content-Type": "application/json", "Host": "httpbin.org", "User-Agent": "NetSuite/2021.1 (SuiteScript)", "X-Amzn-Trace-Id": "Root=1-61426ebd-2163e4f84545532432d5febf" }, "json": { "key1": "custsecret_my_custom_secret", "key2": "custsecret_my_custom_secret", "key3": "{custsecret_my_custom_secret}", "test": "test" }, "origin": "a.b.c.d", "url": "https://httpbin.org/post"}
dbaghdanov
09/15/2021, 10:10 PMis there an example out there of how to use https.SecureString in a post?
b
battk
09/15/2021, 10:13 PMsecrets and guids work as template expressions
battk
09/15/2021, 10:14 PMthe input parameter to a securestring is a template that netsuite renders
battk
09/15/2021, 10:16 PMif you were trying to generate json, you would put the output of
JSON.stringify(body)battk
09/15/2021, 10:17 PMi dont think thats your problem here, because you can also use the body of the https.post as a template input instead
battk
09/15/2021, 10:19 PMid double check that the secret doesnt have a restriction preventing it from running for your script
d
dbaghdanov
09/16/2021, 12:13 AMAH! thanks @battk I get it now:
• Create a string template
• pass that as input to https.createSecureString
• pass that into the https.post
• set the options.credentials
dbaghdanov
09/16/2021, 12:15 AM Copy code
let body = {
test: 'test',
secret: '{custsecret_my_secret}'
};
let secureString = https.createSecureString({
input: JSON.stringify(body)
});
let response = <http://https.post|https.post>({
body: secureString,
url: "<https://httpbin.org/post>",
credentials: ['custsecret_my_secret'],4 Views