I'm reading the OWASP Authentication Cheat Sheet, but it obviously is focused only on web browser. I'm searching for something similar for a desktop app.

I want users to login to a desktop app. The password will be saved on system vault. So user don't login every day.

Each desktop app has an unique id used for login and attached to every request. App, during login, receives a token that can be revoked on the server-side.

Am I missing something? Where can I read some standards or best practice?

  • Why save the password locally? Why not save on the remote service? – schroeder Feb 23 at 13:10
  • I mean the password used for login. – Majascript Feb 23 at 17:37
  • 1
    Are you storing user's password on the desktop app just to avoid having the user login on a regular basis? If so, have you looked at something like OAuth for Desktop apps? developers.google.com/identity/protocols/oauth2/native-app – Limit Feb 23 at 18:01
  • 1
    As an application, you should not store user passwords in a reversible way for such reasons (or rather, any reason). You should rather use auth tokens and refresh tokens. – Limit Feb 23 at 18:44
  • 2
    Seconding everyone else here: don't store the password itself. Everything from OAuth to Minecraft uses a token system, for good reason. Think of them like very long-lived "sessions" that may even be re-issued without the password if it fits the use-case. After all, what's the point of the app receiving a token that "can be revoked" if it also has what it needs to instantaneously get a new one? – JamesTheAwesomeDude Feb 23 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.