Rails Authentication with Devise

Devise is the most popular authentication solution for Rails, providing a complete MVC solution with 10 modular components.

Quick Setup

Add to Gemfile

bundle add devise

Install Devise

rails generate devise:install

Generate User model with authentication

rails generate devise User

Run migrations

rails db:migrate

Essential Configuration

After devise:install , configure in config/environments/development.rb :

config.action_mailer.default_url_options = { host: 'localhost', port: 3000 }

Set root route in config/routes.rb :

root to: 'home#index'

Devise Modules Reference

Enable modules in the model (e.g., app/models/user.rb ):

Module Purpose Migration Columns

:database_authenticatable

Password hashing/storage email , encrypted_password

:registerable

Sign up, edit, destroy account

:recoverable

Password reset via email reset_password_token , reset_password_sent_at

:rememberable

"Remember me" cookie remember_created_at

:trackable

:validatable

Email/password validations

:confirmable

Email confirmation confirmation_token , confirmed_at , confirmation_sent_at , unconfirmed_email

:lockable

Lock after failed attempts failed_attempts , unlock_token , locked_at

:timeoutable

Session expiration

:omniauthable

OAuth provider support

Controller Helpers

Require authentication

before_action :authenticate_user!

Check if signed in

user_signed_in?

Get current user

current_user

Access session

user_session

For other models (e.g., Admin):

before_action :authenticate_admin! admin_signed_in? current_admin admin_session

Common Tasks

Add Custom Fields (e.g., username)

Generate migration:

rails g migration AddUsernameToUsers username:string:uniq rails db:migrate

Permit in ApplicationController :

class ApplicationController < ActionController::Base before_action :configure_permitted_parameters, if: :devise_controller?

protected

def configure_permitted_parameters devise_parameter_sanitizer.permit(:sign_up, keys: [:username]) devise_parameter_sanitizer.permit(:account_update, keys: [:username]) end end

Customize Views

Generate all views

rails generate devise:views

Scoped views for specific model

rails generate devise:views users

Specific modules only

rails generate devise:views -v registrations confirmations

Customize Controllers

Generate controllers

rails generate devise:controllers users

Or specific controller

rails generate devise:controllers users -c sessions registrations

Update routes:

devise_for :users, controllers: { sessions: 'users/sessions', registrations: 'users/registrations' }

Custom Redirect After Sign In

In ApplicationController :

def after_sign_in_path_for(resource) stored_location_for(resource) || dashboard_path end

def after_sign_out_path_for(resource_or_scope) root_path end

Hotwire/Turbo Configuration (Rails 7+)

In config/initializers/devise.rb :

Devise.setup do |config| config.responder.error_status = :unprocessable_entity config.responder.redirect_status = :see_other end

Ensure responders gem version >= 3.1.0.

Testing

RSpec Setup

In spec/support/devise.rb :

RSpec.configure do |config| config.include Devise::Test::ControllerHelpers, type: :controller config.include Devise::Test::ControllerHelpers, type: :view config.include Devise::Test::IntegrationHelpers, type: :feature config.include Devise::Test::IntegrationHelpers, type: :request end

Usage:

sign_in user sign_out user

Minitest Setup

class ActionDispatch::IntegrationTest include Devise::Test::IntegrationHelpers end

Additional Guides

OmniAuth setup: See references/omniauth.md
API authentication: See references/api-auth.md
Advanced patterns: See references/advanced.md

rails-auth-with-devise

Safety Notice

Copy this and send it to your AI assistant to learn