One of our customers had a pen test performed on our application this week and let's just say it didn't go well.
The main issue they have is that user authentication takes place on the client, rather than the server. The reason being that an attacker could decompile our (C#) application and build a modified version which could allow any password to be accepted.
The problem is, a requirement from our customer is that the application needs to work offline, so some sort of authentication will need to be done by the application without communicating with the server.
The pen testers suggested using a token system where the user authenticates with the server and it stores a token in the local database which would be used while offline, but I don't see how this solves the decompiling issue. Surely this could be bypassed in the same way?
Is my only option to tell the customer that if they want the application to be secure, then it can't work offline?
-- additional details
There isn't an "offline-mode" as such, just when an Internet connection is not available (several of the users might take a laptop to farms, for example), so authenticating with a server isn't possible. Admittedly, this isn't as much of an issue as it used to be, with 4G/5G availability.
On first login, after the initial authentication with the server, settings/config data is downloaded and stored in a local database (MSSQL or SQLite). Logging in while offline would allow access this data (so the program can function) and data the user has entered/saved.
The program has to "phone home" occasionally already (the settings expire after a week of no contact with the server), but I can't see how to stop a user from logging into the program if it is decompiled. If it downloads a token from the server, checking this could be bypassed in the same way entering a password could be.
I guess this question boils down to "is it possible to prevent an attacker decompiling my program to circumvent authentication without requiring a server?". So far the only option seems to be to use the user's password as a key to encrypt the data, but then if (when!) the user forgets their password, the data is lost.