Rails Authentication with Devise

Devise is the most popular authentication solution for Rails, providing a complete MVC solution with 10 modular components.

Quick Setup

# Add to Gemfile
bundle add devise

# Install Devise
rails generate devise:install

# Generate User model with authentication
rails generate devise User

# Run migrations
rails db:migrate

Essential Configuration

After devise:install, configure in config/environments/development.rb:

config.action_mailer.default_url_options = { host: 'localhost', port: 3000 }

Set root route in config/routes.rb:

root to: 'home#index'

Devise Modules Reference

Enable modules in the model (e.g., app/models/user.rb):

Module	Purpose	Migration Columns
:database_authenticatable	Password hashing/storage	email, encrypted_password
:registerable	Sign up, edit, destroy account	-
:recoverable	Password reset via email	reset_password_token, reset_password_sent_at
:rememberable	"Remember me" cookie	remember_created_at
:trackable	Sign in stats	sign_in_count, current_sign_in_at, last_sign_in_at, current_sign_in_ip, last_sign_in_ip
:validatable	Email/password validations	-
:confirmable	Email confirmation	confirmation_token, confirmed_at, confirmation_sent_at, unconfirmed_email
:lockable	Lock after failed attempts	failed_attempts, unlock_token, locked_at
:timeoutable	Session expiration	-
:omniauthable	OAuth provider support	-

Controller Helpers

# Require authentication
before_action :authenticate_user!

# Check if signed in
user_signed_in?

# Get current user
current_user

# Access session
user_session

For other models (e.g., Admin):

before_action :authenticate_admin!
admin_signed_in?
current_admin
admin_session

Common Tasks

Add Custom Fields (e.g., username)

1. Generate migration:

rails g migration AddUsernameToUsers username:string:uniq
rails db:migrate

2. Permit in ApplicationController:

class ApplicationController < ActionController::Base
  before_action :configure_permitted_parameters, if: :devise_controller?

  protected

  def configure_permitted_parameters
    devise_parameter_sanitizer.permit(:sign_up, keys: [:username])
    devise_parameter_sanitizer.permit(:account_update, keys: [:username])
  end
end

Customize Views

# Generate all views
rails generate devise:views

# Scoped views for specific model
rails generate devise:views users

# Specific modules only
rails generate devise:views -v registrations confirmations

Customize Controllers

# Generate controllers
rails generate devise:controllers users

# Or specific controller
rails generate devise:controllers users -c sessions registrations

Update routes:

devise_for :users, controllers: {
  sessions: 'users/sessions',
  registrations: 'users/registrations'
}

Custom Redirect After Sign In

In ApplicationController:

def after_sign_in_path_for(resource)
  stored_location_for(resource) || dashboard_path
end

def after_sign_out_path_for(resource_or_scope)
  root_path
end

Hotwire/Turbo Configuration (Rails 7+)

In config/initializers/devise.rb:

Devise.setup do |config|
  config.responder.error_status = :unprocessable_entity
  config.responder.redirect_status = :see_other
end

Ensure responders gem version >= 3.1.0.

Testing

RSpec Setup

In spec/support/devise.rb:

RSpec.configure do |config|
  config.include Devise::Test::ControllerHelpers, type: :controller
  config.include Devise::Test::ControllerHelpers, type: :view
  config.include Devise::Test::IntegrationHelpers, type: :feature
  config.include Devise::Test::IntegrationHelpers, type: :request
end

Usage:

sign_in user
sign_out user

Minitest Setup

class ActionDispatch::IntegrationTest
  include Devise::Test::IntegrationHelpers
end

Additional Guides

• OmniAuth setup: See references/omniauth.md
• API authentication: See references/api-auth.md
• Advanced patterns: See references/advanced.md