Is Canvas Auth a secure alternative to the original Web site authentication?

Question

I'm currently investigating how to use a Canvas app to display a web app page (i.e running on Heroku). This web app has a user + password login method.

When creating this Canvas app, I researched the authentication methods and decided to go with Signed Requests for a PoC. My conclusion was that after updating the web app to use the SDK and signed requests, the user + password authentication is not required for a salesforce user accessing the canvas app.

And my question is: Isn't it insecure that a Salesforce user can access the web page without requiring user+pass anymore? Would the owner of the web page feel safe with this modification?

Note that I understand that the signed request method is verifying the connected-app secrets and authorizing the Canvas request, however, I still have doubts about the security of that. Same doubts if I use OAuth authentication.

Answer 1

Isn't it insecure that a Salesforce user can access the web page without requiring user+pass anymore?

It's demonstrably more secure, actually. By offloading security to a third party, that means that you don't have to worry about figuring out the correct way to hash and salt passwords, securing access to login tables, don't have to implement 2FA/MFA/SSO, or whatever else the user might want to do to secure their account, etc. Imagine getting the full suite of Salesforce security features with minimum effort. If a user has their username and password compromised on your app, that's one more password they have to remember to change. Many accounts that are not used frequently can be forgotten, and those passwords could be compromised at any time.

Would the owner of the web page feel safe with this modification?

The owner should. After all, billions of usernames and passwords are leaked every year. As I stated above, the owner is getting a bunch of security features for free. This means that the developers only have to worry about a very small attack area, the part of the app that deals with sessions. A user can even log out of your site by logging out of Salesforce, or ending a compromised session from a central location. It makes it far easier to keep your own site secure when you don't have any control over the authentication process.