We currently have an integration with our external platform inside salesforce by using IFrames. For authentication we pass the Salesforce session as a query string parameter inside the IFrame address and do callback authentication from our external platform. But our client now feels this mode is insecure as we pass salesforce session id in plaintext.
Can we improve this by anyway? I also feel this is a old way of doing integration. Are there any better methods available now?