{"id":46367187,"url":"https://github.com/theoperatore/destiny-auth-proxy","last_synced_at":"2026-03-05T02:33:30.765Z","repository":{"id":57166084,"uuid":"162173944","full_name":"theoperatore/destiny-auth-proxy","owner":"theoperatore","description":"A simple refresh token server for handling Destiny OAuth tokens","archived":false,"fork":false,"pushed_at":"2018-12-22T01:50:58.000Z","size":129,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-08-08T23:17:17.579Z","etag":null,"topics":["bungie","bungie-api","bungie-destiny-api","bungie-net","destiny2","destiny2api","destinythegame"],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/theoperatore.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-12-17T18:34:29.000Z","updated_at":"2020-06-12T16:23:59.000Z","dependencies_parsed_at":"2022-08-30T15:10:19.038Z","dependency_job_id":null,"html_url":"https://github.com/theoperatore/destiny-auth-proxy","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/theoperatore/destiny-auth-proxy","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theoperatore%2Fdestiny-auth-proxy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theoperatore%2Fdestiny-auth-proxy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theoperatore%2Fdestiny-auth-proxy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theoperatore%2Fdestiny-auth-proxy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/theoperatore","download_url":"https://codeload.github.com/theoperatore/destiny-auth-proxy/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theoperatore%2Fdestiny-auth-proxy/sbom","scorecard":{"id":879592,"data":{"date":"2025-08-11","repo":{"name":"github.com/theoperatore/destiny-auth-proxy","commit":"1215d2cf39fcf44bf91d5f13c96acfd5a648267a"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":1.3,"checks":[{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"SAST","score":0,"reason":"no SAST tool detected","details":["Warn: no pull requests merged into dev branch"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Code-Review","score":0,"reason":"Found 0/14 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":-1,"reason":"no dependencies found","details":null,"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":0,"reason":"license file not detected","details":["Warn: project does not have a license file"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Vulnerabilities","score":0,"reason":"80 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-6chw-6frg-f759","Warn: Project is vulnerable to: GHSA-v88g-cgmw-v5xw","Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw","Warn: Project is vulnerable to: GHSA-fwr7-v2mv-hh25","Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92","Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7","Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw","Warn: Project is vulnerable to: GHSA-cwfw-4gq5-mrqx","Warn: Project is vulnerable to: GHSA-g95f-p29q-9xw4","Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg","Warn: Project is vulnerable to: GHSA-257v-vj4p-3w2h","Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x","Warn: Project is vulnerable to: GHSA-h452-7996-h45h","Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275","Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c","Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq","Warn: Project is vulnerable to: GHSA-3gx7-xhv7-5mx3","Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc","Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx","Warn: Project is vulnerable to: GHSA-fjxv-7rqg-78g4","Warn: Project is vulnerable to: GHSA-8r6j-v8pm-fqw3","Warn: Project is vulnerable to: MAL-2023-462","Warn: Project is vulnerable to: GHSA-4q6p-r6v2-jvc5","Warn: Project is vulnerable to: GHSA-q42p-pg8m-cqh6","Warn: Project is vulnerable to: GHSA-w457-6q6x-cgp9","Warn: Project is vulnerable to: GHSA-62gr-4qp9-h98f","Warn: Project is vulnerable to: GHSA-f52g-6jhx-586p","Warn: Project is vulnerable to: GHSA-2cf5-4w76-r9qv","Warn: Project is vulnerable to: GHSA-3cqr-58rm-57f8","Warn: Project is vulnerable to: GHSA-g9r4-xpmj-mj65","Warn: Project is vulnerable to: GHSA-q2c6-c6pm-g3gh","Warn: Project is vulnerable to: GHSA-765h-qjxv-5f44","Warn: Project is vulnerable to: GHSA-f2jv-r9rf-7988","Warn: Project is vulnerable to: GHSA-c3m8-x3cg-qm2c","Warn: Project is vulnerable to: GHSA-43f8-2h32-f4cj","Warn: Project is vulnerable to: GHSA-qqgx-2p2h-9c37","Warn: Project is vulnerable to: GHSA-2pr6-76vf-7546","Warn: Project is vulnerable to: GHSA-8j8c-7jfh-h6hx","Warn: Project is vulnerable to: GHSA-896r-f27r-55mw","Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h","Warn: Project is vulnerable to: GHSA-6c8f-qphg-qjgp","Warn: Project is vulnerable to: GHSA-jf85-cpcp-j695","Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw","Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9","Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm","Warn: Project is vulnerable to: GHSA-4xcv-9jjx-gfj3","Warn: Project is vulnerable to: GHSA-7wpw-2hjm-89gp","Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv","Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3","Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m","Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h","Warn: Project is vulnerable to: GHSA-fhjf-83wg-r2j9","Warn: Project is vulnerable to: GHSA-8hfj-j24r-96c4","Warn: Project is vulnerable to: GHSA-wc69-rhjr-hc9g","Warn: Project is vulnerable to: GHSA-5fw9-fq32-wv5p","Warn: Project is vulnerable to: GHSA-76c9-3jph-rj3q","Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9","Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j","Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w","Warn: Project is vulnerable to: GHSA-g6ww-v8xp-vmwg","Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp","Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6","Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw","Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg","Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p","Warn: Project is vulnerable to: GHSA-4g88-fppr-53pp","Warn: Project is vulnerable to: GHSA-4jqc-8m5r-9rpr","Warn: Project is vulnerable to: GHSA-3jfq-g458-7qm9","Warn: Project is vulnerable to: GHSA-r628-mhmh-qjhw","Warn: Project is vulnerable to: GHSA-9r2w-394v-53qc","Warn: Project is vulnerable to: GHSA-5955-9wpr-37jh","Warn: Project is vulnerable to: GHSA-qq89-hq3f-393p","Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36","Warn: Project is vulnerable to: GHSA-52f5-9888-hmc6","Warn: Project is vulnerable to: GHSA-jgrx-mgxx-jf9v","Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3","Warn: Project is vulnerable to: GHSA-6fc8-4gx4-v693","Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q","Warn: Project is vulnerable to: GHSA-c4w7-xm78-47vh","Warn: Project is vulnerable to: GHSA-p9pc-299p-vxgp"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-24T07:34:32.999Z","repository_id":57166084,"created_at":"2025-08-24T07:34:32.999Z","updated_at":"2025-08-24T07:34:32.999Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30107221,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-05T01:39:18.192Z","status":"online","status_checked_at":"2026-03-05T02:00:06.710Z","response_time":93,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bungie","bungie-api","bungie-destiny-api","bungie-net","destiny2","destiny2api","destinythegame"],"created_at":"2026-03-05T02:33:30.112Z","updated_at":"2026-03-05T02:33:30.753Z","avatar_url":"https://github.com/theoperatore.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Destiny Auth Proxy\n\nA simple server to help with refreshing tokens so your users can stop having to keep logging into Bungie to get access to your awesome app!\n\nThis flow is for those Bungie applications that are using the `Confidential OAuth Client Type`. See the [Bungie OAuth Documentation](https://github.com/Bungie-net/api/wiki/OAuth-Documentation) for more info.\n\nThis simple auth proxy server supports many domains and many clientId/clientSecret pairs; as many separate Bungie applications as you want!\n\n### How it works\n\nWhen your app starts up try to get a token from the auth proxy:\n\n`https://\u003cdestiny-auth-proxy-domain\u003e/token?clientId=\u003cclientId\u003e`\n\nThis will either return an auth token and membership id to use, or it will respond with `401 Unauthorized`.\n\nIf you are unauthorized, redirect the user to Bungie's authorization endpoint:\n\n`https://www.bungie.net/en/oauth/authorize?client_id=CLIENT_ID\u0026response_type=code`.\n\nOnce you get your code, use that to try to get another token from the auth proxy:\n\n`https://\u003cdestiny-auth-proxy-domain\u003e/token?clientId=\u003cclientId\u003e\u0026code=\u003cauthCodeFromBungie\u003e`\n\nBy sending the `authCodeFromBungie` and the `clientId`, the auth proxy can obtain an auth token and `refresh_token` and send them to you. At the same time, the proxy sets a cookie to help with the next time you want to authenticate (without having to redirect to Bungie's authorization endpoint).\n\nOn subsequent refreshes to your application, the auth proxy should be able to return a newly refreshed token by reading the cookie that was set during the last successful OAuth attempt.\n\nBe sure that any `401` from the auth proxy is handled by redirecting to Bungie to get another `authCode`.\n\n### Requirements\n\n| engine | version   |\n| ------ | --------- |\n| node   | `10.14.2` |\n\nEasiest way to get that version is to use [nvm](https://github.com/creationix/nvm). Once that's installed it's just:\n\n```bash\nnvm install\n```\n\nand it'll pick up the correct node version.\n\n### SSL Requirement\n\nBecause Bungie's authorization callback endponts require `https` (they won't let you do `http`), this proxy needs to be run using an ssl certificate.\n\nThe best way to specify where you `cert` and `key` are is using the environment variables: `DESTINY_AUTH_PROXY_CERT_PATH` and `DESTINY_AUTH_PROXY_KEY_PATH`. Set those to the **absolute path** of your key and certficate files and the server will pick them up.\n\nThe server and cli are set up to use [dotenv](https://github.com/motdotla/dotenv). For easy environment variable configuring, make a `.env` file and put:\n\n```\nDESTINY_AUTH_PROXY_CERT_PATH=Absolute/Path/To/Cert\nDESTINY_AUTH_PROXY_KEY_PATH=Absolute/Path/To/Key\n```\n\nAnd run your proxy.\n\n#### Developing locally\n\nSince using https is a hard requirement, obtaining a license to develop locally is kind of a pain, but doable.\n\n1. [Follow these directions from Let's Encrypt to generate your cert](https://letsencrypt.org/docs/certificates-for-localhost/)\n2. Get your OS to always trust that certificate you just generated. On MacOS, that's in **Keychain Access**.\n3. Set `DESTINY_AUTH_PROXY_CERT_PATH` and `DESTINY_AUTH_PROXY_KEY_PATH` to the absolute paths of the cert and key you just created and trusted.\n\nIf you don't want to do this yourself, then [these cert generator scripts](https://github.com/dakshshah96/local-cert-generator/) seem good.\n\n### Installation\n\nThere are two main ways to use the server; `cli` or `nodejs`.\n\n#### Nodejs Installation\n\n```bash\n# or npm install\nyarn add @theoperatore/destiny-auth-proxy\n```\n\n#### Nodejs usage\n\n```js\n// your server.js file or whatever...\nconst createServer = require('@theoperatore/destiny-auth-proxy');\nconst port = process.env.PORT || 1337;\n\nconst clientId = process.env.BUNGIE_CLIENT_ID;\nconst clientSecret = process.env.BUNGIE_CLIENT_SECRET,\n\nconst authorizedClients = {\n  [clientId]: clientSecret,\n};\n\nconst authorizedDomains = [\n  'https://my-destiny-app.com',\n];\n\nconst app = createServer(authorizedClients, authorizedDomains);\n\n// enable some logging - see below for more info\napp.enableConsoleLogging();\napp.enableFileLogging();\n\nconst server = app.listen(port, () =\u003e console.log('server up at:', port));\n```\n\n#### cli installation\n\n```bash\n# npm install -g\nyarn global add @theoperatore/destiny-auth-proxy\n```\n\nThis will install the `destiny-auth-proxy` executable. Using the cli will automatically set `NODE_ENV` to `production` and enable file logging.\n\n#### cli basic usage\n\n```bash\n# client and domain can be used multiple times\ndestiny-auth-proxy --client=\u003cclientId:clientSecret\u003e --domain=\"https://my-desinty-app.com\" --port=\u003cport\u003e\n\n# for complete info\ndestiny-auth-proxy --help\n```\n\n### Logging\n\nRunning the server from the cli will automatically enable file logging. You will have to manually enable file or console logging when using the node api.\n\nEnabling file logging will cause the server to log all traffic out to a rotating daily file. These files are kept for 14days before being archived.\n\nIf you want to log to the console AND to the production logs, then add a `-v` when running the cli or call `app.enableConsoleLogging()`.\n\n### License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftheoperatore%2Fdestiny-auth-proxy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftheoperatore%2Fdestiny-auth-proxy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftheoperatore%2Fdestiny-auth-proxy/lists"}