I am planning to use a Canvas app for one of the AppExchange app. It will load the 3rd party page within Salesforce.

I am planning to use the Signed Request approach where the external website will implement Canvas SDK and it will authenticate the signed request.

Currently, the external site has authentication by using a username and password. As we are planning to use the signed approach, the external app will have one more way of authentication by signed request.

Question: As we are planning to use Canvas App within AppExchange with the Signed Request approach, is the signed request approach enough from a Security Review perspective or will it be mandatory to implement a single sign-on with the users of an external website? With a signed request, there will be additional validation like a valid SF user from a valid SF org is viewing the page or not.

1 Answer 1


You should open an office hour with the Salesforce Security Team to confirm on this.

From my experience, a Signed Request is a very valid approach and it is a secure way of authentication and been approved. Although using OAuth 2.0 layer on top of it gives benefits that users also have the ability to authorize.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .