If I'm not mistaken, in webapps there are a lot of potential attack vectors, such as http header spoofing and what not, which are not there in typical rich-client desktop applications, such as WPF applications. To add a bit more motivation to my question, I have the feeling that most security related issues I come across in news and blog articles concern webapps. Me being a desktop developer with 0 experience in web-development, I began to wonder: are rich-client apps inherently more secure than webapps?
For example, can a simple desktop app with a classic login (username + password), a database (that resides on a remote server) that only contains usernames with hashed passwords (and salt), without any other "authentication" process, be considered less vulnerable overall (lets say towards the most common types of attacks) than a webapp that does the same?
Perhaps to make my question more focussed, based on the comments I received: What are some of the main security concerns for each type? Are there any potential vulnerabilities that exist in one but definitely aren't worrysome to the other?
Please note that I am not considering scenarios where one uses technologies of the other. For example, the desktop app should do what it does without any usage of web technologies or protocols (such as HTTP).