User login from desktop application to Website best practice (.NET) - json

Question

UPDATE: I looked back at what I wrote up and there are too many communication layers. I am going to move forward and handle all authentication in Windows Form, generate a token there, and use it to open up the web app locally. I just need to figure out how to open a website within windows forms that can accept a model. Right now I can do, but I can only pass 1 object:
string endpointURL = "https://localhost:44318/api/login?token=" + tokenstring;
I would rather post a model, and then trigger that to open the webpage by hitting this controller endpoint in the web app
[HttpPost]
public ActionResult SecureLogin([FromBody]AuthenticateModel model)
{
return RedirectToAction("MainView", "Home", model.userID);
}
END UPDATE
I am developing a .NET Core web application. The users will login from a installed Windows Forms app I am also making. I have not done this specific way of logging in so I am looking for some advice on best practice. Here is my current process that works in development:
Desktop App accepts credentials
Once credentials are accepted a request will be sent to the web app server using a json login request
string url = "https://localhost:44318/api/TestPostData";
var httpWebRequest = (HttpWebRequest)WebRequest.Create(url);
httpWebRequest.ContentType = "application/json; charset=utf-8";
httpWebRequest.Method = "POST";
httpWebRequest.Accept = "application/json; charset=utf-8";
using (var streamWriter = new StreamWriter(httpWebRequest.GetRequestStream()))
{
string loginjson = new JavaScriptSerializer().Serialize(new
{
Username = "postTest",
Password = "password"
});
streamWriter.Write(loginjson);
streamWriter.Flush();
streamWriter.Close();
var httpResponse = (HttpWebResponse)httpWebRequest.GetResponse();
Web app hears the login request, verifies with DB credentials are good
If credentials are good, the server will generate a JSON Web Token.
The token will be saved to the DB as a temporary login permission tied to that userID
The token is sent back to the local client, and put in the URL to open the web application
The web app sees this token being used to access the platform, verifies it is good and outputs the data ties to the userID

Answer 1

A few thoughts:
The beauty of Json web tokens is that because they are cryptographically signed, you don’t need to store them in your database. Put the username in the payload, along with other useful data like the IP, and then check their validity directly, saving yourself some db overhead.
Guard against leaked tokens by limiting the validity of the token, both in terms of an expiry time and to one IP address.
Securely hash passwords as near to the user as possible, depending on how your authentication backend works.
Json web tokens are best put in an http authorization header using the bearer mechanism.
When implementing this, stick to using implementations based on trusted and well-maintained libraries. Avoid rolling-your-own to the maximum extent possible. The devil is usually in the details.