Consider the following situation: I am developing a website, and a native Windows/Mac executable to go along with it. The executable registers itself under a URI scheme so that it can be launched from the website - but it also has no login system of its own to identify the user (nor would something like IP-matching between browser user and app user be reliable).
I would like to associate some information with the launch URI so that the user can launch straight into it with no login. Eg:
<a href="myapp://perform-action-xyz?randomUserAuthToken=ik423hyi8fehs3590ufds">Launch the app!</a>
This token is the only information that the (publically available) app would use to trust that this user is who they say they are (I cannot find any other way of passing information automatically from the browser to the app). Any attempt to obfuscate this connected information would be pointless as long as the same string copied and pasted to a hacker's machine would grant the same access. This token would have a logical expiration time on it about an hour or two later. At that point, the executable would have no access to user information.
I hope that this question is not too nebulous, but I am trying to form some strong confidence that this is a safe way of authenticating users. There has been some concern about where a CMD launch string might be saved somewhere in a windows event log, or whether that hour or so expiration time might reasonably grant a window for someone capable of stealing it to hijack a session. There are also some thoughts that any URI should not contain sensitive data inside the query string, but I'd like to be clear on the reasoning for that and whether it pertains to these special app-launch strings. I don't have information on how this sort of attack might be abused, which is why I am looking for more information on what concerns may exist.