This site was built to compliment the existing NetSuite Professionals Slack Community by adding a means for members to easily find answers to common questions and to create a searchable database of those questions and answers.

NetSuite Professionals

Is enabling HSTS no longer handled by NetSuite? I thought support can enable it when a customer requests for it?

Your support rep is misinformed, we can do that on request

thank you for confirming! how can we push this so the request gets completed?

hi <@U8X7E86M6> --- NS Support keeps pushing us back and giving us an update from 2019 from an enhancement.

&gt; _“At this time, global HSTS cannot be implemented across all domains, including all secure domains. This is because certain use cases—such as disaster recovery, migration, and CDN changes—require the ability to switch secure domains back to non-secure._
&gt; _An opt-in approach for strict transport security may be possible in the future; however, this would require a separate enhancement that includes user-facing configuration (such as domain and max-age settings), rather than being part of the standard feature set.”_
I've already asked the client to escalate a while back.

They also recommended us ACS/PS for for custom solutions but I don't know how can this be done via customization.

Is this something that you might be able to confirm internally?

This cannot be done as a customisation because we don't let you set that header

<@U8X7E86M6> just wanna say thank you again for the push here! Support just gave us an update that they finally received the go signal to move forward in enabling it for the customer's account.

Happy to help. We hope to be able to prioritise HSTS on by default soon