In case of Desktop application, the application itself maintains a state [session] for the user. While in case of web applicatioin it is stateless[http], so everytime the user needs authentication.