A simple heroku-ready app for proxying oauth requests for front end only apps. This is a reference implementation of the ideas presented by Alex Bilbie in his blog post: OAuth and Single Page JavaScript Web-Apps.

This proxy should work with any OAuth2 enabled API that accepts Bearer tokens and supports the authorization_code login flow.

The easiest way to get started with this proxy is to deploy it to a free heroku instance using the button below. This button will setup most of the required variables with defaults to use the US Battle.net API. It's easy to change from these defaults if you need to. If you do want to use this proxy for the Battle.net APIs than you only need to add in your CLIENT_ID, CLIENT_SECRET and REDIRECT_URL.

This proxy will help log in users using a standard OAuth2 Authorization Code flow and then redirect them back to your app with an encrypted access token in the URL fragment.

Now your app can pass that fragment as the Authorization header in other requests to this proxy. These requests will be sent to the proxied API with a proper OAuth2 Authorization: Bearer token header. This allows you to use the authorization code flow for front end only apps while keeping your CLIENT_SECRET safe.

If you want to run this proxy on Heroku for the US Battle.net API than these are the steps you need to follow:

1. Register on https://dev.battle.net and generate an account. You can leave the Register Callback URL field blank for now.
2. Click the Heroku deploy button above and fill in your CLIENT_ID and CLIENT_SECRET with the data from your https://dev.battle.net account (Key and Secret). Put your front end app's url as the REDIRECT_URL. Whatever url you put here will have #token=<token>&iv=<iv> appended to it after login.
3. Make note of your heroku app url and add it to your https://dev.battle.net account as the Register Callback URL with /auth/oauth2/callback as the path. For example, if your heroku app is named sample-app then the callback url shoudl be https://sample-app.herokuapp.com/auth/oauth2/callback.
4. When you want your users to login to the Battle.net API redirect them to <your herouku app>/auth/oauth2.
5. When we redirect the user back to your app save the token and iv values.
6. When you need to make an API call make it to <your heroku app>/rest/of/the/api/call and include an Authorization header in the form of Authorization: token=<token> iv=<iv>

These are the configuration variables that this proxy needs to run. If you want to use the US Battle.net API and use the Heroku deploy button above, you only need to setup the BOLDED ones.