rails-auth-with-devise

Rails Authentication with Devise

Devise is the most popular authentication solution for Rails, providing a complete MVC solution with 10 modular components.

Quick Setup

# Add to Gemfile
bundle add devise

# Install Devise
rails generate devise:install

# Generate User model with authentication
rails generate devise User

# Run migrations
rails db:migrate

Essential Configuration

After devise:install, configure in config/environments/development.rb:

config.action_mailer.default_url_options = { host: 'localhost', port: 3000 }

Set root route in config/routes.rb:

root to: 'home#index'

Devise Modules Reference

Enable modules in the model (e.g., app/models/user.rb):

| Module | Purpose | Migration Columns | |--------|---------|-------------------| | :database_authenticatable | Password hashing/storage | email, encrypted_password | | :registerable | Sign up, edit, destroy account | - | | :recoverable | Password reset via email | reset_password_token, reset_password_sent_at | | :rememberable | "Remember me" cookie | remember_created_at | | :trackable | Sign in stats | sign_in_count, current_sign_in_at, last_sign_in_at, current_sign_in_ip, last_sign_in_ip | | :validatable | Email/password validations | - | | :confirmable | Email confirmation | confirmation_token, confirmed_at, confirmation_sent_at, unconfirmed_email | | :lockable | Lock after failed attempts | failed_attempts, unlock_token, locked_at | | :timeoutable | Session expiration | - | | :omniauthable | OAuth provider support | - |

Controller Helpers

# Require authentication
before_action :authenticate_user!

# Check if signed in
user_signed_in?

# Get current user
current_user

# Access session
user_session

For other models (e.g., Admin):

before_action :authenticate_admin!
admin_signed_in?
current_admin
admin_session

Common Tasks

Add Custom Fields (e.g., username)

1. Generate migration:

rails g migration AddUsernameToUsers username:string:uniq
rails db:migrate

1. Permit in ApplicationController:

class ApplicationController < ActionController::Base
  before_action :configure_permitted_parameters, if: :devise_controller?

  protected

  def configure_permitted_parameters
    devise_parameter_sanitizer.permit(:sign_up, keys: [:username])
    devise_parameter_sanitizer.permit(:account_update, keys: [:username])
  end
end

Customize Views

# Generate all views
rails generate devise:views

# Scoped views for specific model
rails generate devise:views users

# Specific modules only
rails generate devise:views -v registrations confirmations

Customize Controllers

# Generate controllers
rails generate devise:controllers users

# Or specific controller
rails generate devise:controllers users -c sessions registrations

Update routes:

devise_for :users, controllers: {
  sessions: 'users/sessions',
  registrations: 'users/registrations'
}

Custom Redirect After Sign In

In ApplicationController:

def after_sign_in_path_for(resource)
  stored_location_for(resource) || dashboard_path
end

def after_sign_out_path_for(resource_or_scope)
  root_path
end

Hotwire/Turbo Configuration (Rails 7+)

In config/initializers/devise.rb:

Devise.setup do |config|
  config.responder.error_status = :unprocessable_entity
  config.responder.redirect_status = :see_other
end

Ensure responders gem version >= 3.1.0.

Testing

RSpec Setup

In spec/support/devise.rb:

RSpec.configure do |config|
  config.include Devise::Test::ControllerHelpers, type: :controller
  config.include Devise::Test::ControllerHelpers, type: :view
  config.include Devise::Test::IntegrationHelpers, type: :feature
  config.include Devise::Test::IntegrationHelpers, type: :request
end

Usage:

sign_in user
sign_out user

Minitest Setup

class ActionDispatch::IntegrationTest
  include Devise::Test::IntegrationHelpers
end

Additional Guides

• OmniAuth setup: See [references/omniauth.md](references/omniauth.md)
• API authentication: See [references/api-auth.md](references/api-auth.md)
• Advanced patterns: See [references/advanced.md](references/advanced.md)