#151 with Rails 6
Running devise with Rails 6
Notes
Checking Pre-requisites and Basic App Build
$ node -v
v12.8.0
$ npm -v
6.10.2
$ ruby -v
ruby 2.7.2p137 (2020-10-01 revision 5445e04352) [x86_64-darwin17]
$ sqlite3 --version
3.19.3 2017-06-27 16:48:08 2b0954060fe10d6de6d479287dd88890f1bef6cc1beca11bc6cdb79f72e2377b
$ gem install rails
...
$ bundle config --local disable_platform_warnings true # to make dependency tzinfo-data warning go away
$ rails --version
Rails 6.0.3.4
Build a simple app with an Article
model and controller:
$ rails new demo
...
$ cd demo
$ rails generate controller Welcome index
$ rails generate scaffold Article title:string text:text
$ rails db:migrate
some tidy up
$ cd demo
$ rm -fR .git # --skip-git would do this, but also means no .gitignore generated
Adding Devise
Add the devise gem to the Gemfile
and bundle install
$ rails generate devise:install
$ rails generate devise:views
$ rails generate devise User
App Customization
Require authentication for the articles controller:
class ArticlesController < ApplicationController
before_action :authenticate_user!
...
Add sign-in/out links in the application layout:
<%- unless controller.class.name.include? 'Devise' %>
<%- if user_signed_in? %>
<%= link_to 'Log Out', destroy_user_session_path, method: :delete %><br />
<% else %>
<%= link_to 'Log In', new_user_session_path %><br />
<% end %>
<% end %>
Devise Modules
Devise is a pluggable authentication system that uses warden under the cover for rack-based authentication.
Devise comes with 10 standard modules, 5 of which are enabled by default:
- Database Authenticatable: hashes and stores a password in the database to validate the authenticity of a user while signing in. The authentication can be done both through POST requests or HTTP Basic Authentication.
- Recoverable: resets the user password and sends reset instructions.
- Registerable: handles signing up users through a registration process, also allowing them to edit and destroy their account.
- Rememberable: manages generating and clearing a token for remembering the user from a saved cookie.
- Validatable: provides validations of email and password. It’s optional and can be customized, so you’re able to define your own validations.
The remaining 5 can be enabled as needed. Usually this just means updating the devise
parameters in the user model, and checking module-specific items in the devise configuration file:
- Omniauthable: adds OmniAuth support.
- Confirmable: sends emails with confirmation instructions and verifies whether an account is already confirmed during sign in.
- Trackable: tracks sign in count, timestamps and IP address.
- Timeoutable: expires sessions that have not been active in a specified period of time.
- Lockable: locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.
Third-party modules are available for other authentication requirements such as devise_invitable Devise modules are actually aquite easy to develop to suit specific requirements.
Examples
Root page (before sign-in)
Attempt to access articles will redirect to sign-in:
Managing articles after sign-in:
Credits and References
- Devise Blog - plataformatec
- Devise - rubygems
- Devise - github
- warden