I'm reading the OWASP Authentication Cheat Sheet, but it obviously is focused only on web browser. I'm searching for something similar for a desktop app.
I want users to login to a desktop app. The password will be saved on system vault. So user don't login every day.
Each desktop app has an unique id used for login and attached to every request. App, during login, receives a token that can be revoked on the server-side.
Am I missing something? Where can I read some standards or best practice?