Custom code written for the Salesforce platform is incapable of making a PATCH request to an external server (PUT and POST are okay though), and I need to make a PATCH request to an external service (Microsoft Graph).
While authentication can be handled with a POST request directly from SF to MSG, obtaining the access token, I can't make the second callout, which is a PATCH. So for that, I wrote a simple Heroku-based Flask application that receives a POST request and then uses the Requests library to make the PATCH request to MSG.
From a practical point of view, this works as intended. However, from a security point of view, I would like to confirm if it is safe to assume that this approach is safe as well.
The Heroku dyno receives a POST containing the token, the endpoint to call and a "payload" which is the exact JSON I'd send to MSG directly. Of course, the connection to the dyno is secured through HTTPS, and the SF administrator has access to the URL (but not the dyno's code or repository). This way, the Flask app knows who to call, which token to use, and what is the JSON data to send.
Given that the dyno doesn't store anything, and simply forwards the callouts, could this be considered a safe approach?