I'm currently investigating how to use a Canvas app to display a web app page (i.e running on Heroku). This web app has a user + password login method.
When creating this Canvas app, I researched the authentication methods and decided to go with Signed Requests for a PoC. My conclusion was that after updating the web app to use the SDK and signed requests, the user + password authentication is not required for a salesforce user accessing the canvas app.
And my question is: Isn't it insecure that a Salesforce user can access the web page without requiring user+pass anymore? Would the owner of the web page feel safe with this modification?
Note that I understand that the signed request method is verifying the connected-app secrets and authorizing the Canvas request, however, I still have doubts about the security of that. Same doubts if I use OAuth authentication.