{"id":365,"date":"2009-10-21T00:46:58","date_gmt":"2009-10-21T02:46:58","guid":{"rendered":"http:\/\/blog.plataformatec.com.br\/?p=365"},"modified":"2009-11-05T20:48:32","modified_gmt":"2009-11-05T22:48:32","slug":"devise-flexible-authentication-solution-for-rails","status":"publish","type":"post","link":"https:\/\/blog.plataformatec.com.br\/2009\/10\/devise-flexible-authentication-solution-for-rails\/","title":{"rendered":"Devise: flexible authentication solution for Rails"},"content":{"rendered":"
UPDATE:<\/strong> This post was an introduction to Devise and a couple of things changed since then. There is a more recent post which describes the same steps as below using generators<\/a> and, for a more complete and always updated explanation, please check the README<\/a>.<\/p>\n In Rails Summit Latin America 2009<\/a>, we showed Devise<\/a> in a lightning talk and today we are officially releasing it! Before we show you some code, we are going to explain what we want to achieve with Devise<\/a>, starting with the most used authentication solution nowadays: Clearance<\/a> and Authlogic<\/a>.<\/p>\n Clearance<\/a> is a full stack authentication solution, implementing all Model, View and Controller layers using Rails Engines. It deals with account confirmation and password recovery. You just need to plug and play! However, you are required to use the model User and it does not allow you have add and\/or customize different roles.<\/p>\n When comes to the Model, Authlogic<\/a> is definitely the most complete solution out there. It handles several cryptography providers and many other goodies which are completely configurable. However, it’s not a full stack solution (it does not say how users should confirm their account or recover their password) and it has a little bit of controversy since it handles the session in a model. So here is the question, where the session could be handled then?<\/p>\n Warden<\/a> is a general rack authentication framework, developed by Daniel Neighman<\/a>, which handles the session in a rack middleware. The main benefit from it is that you can share your authentication strategies with several apps, so if you are using Sinatra, Rails and some others middlewares at the same time, they all rely on the same rules!<\/p>\n After we fell in love with Warden<\/a> and used it in some projects, we decided to create a full stack solution as Clearance, but flexible as Authlogic, on top of Warden<\/a>. The solution is Devise<\/a>, a Rails Engine which handles multiple roles, each one of them with different strategies. Devise currently comes with 5 strategies:<\/p>\n The nice thing is: imagine that you are building an app which needs to handle invitations. You just need to create a Invitable strategy on Devise and never implement it again!<\/p>\n In the README<\/a>, you will find all the information you need to start using Devise in your projects, so here we are going to cover the main aspects of it. Let’s suppose you are creating an user model, which needs to be authenticated and recover his password. The first step is to create the columns using Devise migration helpers:<\/p>\n Then you need to declare inside your model which strategies you want to use:<\/p>\n And create the routes:<\/p>\n The route will access your model and create only the routes for the strategies declared. That ensures that your user won't access the confirmations controller inside Devise. Devise also adds a couple of helpers and filters to be used inside your controllers:<\/p>\n user_session<\/strong> is a hash scoped only to the user. So if you have two roles, they will have different session hashes and their data won't conflict! This awesome feature come straights from Warden!<\/p>\n Devise also has I18n support and since it's an engine, you can customize your views just by placing a copy of it in your application. A small application build as example is also available on Github<\/a>!<\/p>\n We are planning to add several other strategies to Devise, including brute force protection, session timeouts and also other features, as generators. You can spy our TODO list<\/a> whenever you want.<\/p>\n Carlos Ant\u00f4nio<\/a> which worked on Devise and made it ready for prime time! Jonas Nicklas<\/a>, which introduced us to Warden<\/a> and Daniel Neighman<\/a> for building and maintaining it! <\/p>\n We also want to thank Thoughtbot<\/a> guys, which wrote several decisions<\/a> and tips<\/a> they took while developing Clearance<\/a> which helped us while building Devise<\/a>.<\/p>\n Finally, thanks to F\u00e1bio Akita<\/a> for giving us the chance to release it at Rails Summit and Gregg Pollack for releasing Devise on Ruby 5<\/a>!<\/p>\n","protected":false},"excerpt":{"rendered":" UPDATE: This post was an introduction to Devise and a couple of things changed since then. There is a more recent post which describes the same steps as below using generators and, for a more complete and always updated explanation, please check the README. In Rails Summit Latin America 2009, we showed Devise in a … \u00bb<\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[1],"tags":[37,36,39,23,7],"aioseo_notices":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/365"}],"collection":[{"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/comments?post=365"}],"version-history":[{"count":24,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/365\/revisions"}],"predecessor-version":[{"id":424,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/365\/revisions\/424"}],"wp:attachment":[{"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/media?parent=365"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/categories?post=365"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/tags?post=365"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Clearance<\/h3>\n
Authlogic<\/h3>\n
Here comes Warden!<\/h3>\n
Devise: strategies for authentication<\/h3>\n
\n
Show me the code!<\/h3>\n
\r\ncreate_table :users do |t|\r\n # creates email, encrypted_password and password_salt\r\n t.authenticatable\r\n\r\n # creates reset_password_token\r\n t.recoverable\r\nend\r\n<\/pre>\n
\r\nclass User < ActiveRecord::User\r\n # Authenticatable is always included\r\n devise :recoverable, :validatable\r\nend\r\n<\/pre>\n
\r\nActionController::Routing::Routes.draw do |map|\r\n # Check for configuration params on README\r\n map.devise_for :users\r\nend\r\n<\/pre>\n
\r\n # Inside your protected controller\r\n before_filter :authenticate_user!\r\n\r\n # Inside your controllers and views\r\n user_signed_in?\r\n current_user\r\n user_session\r\n<\/pre>\n
What's more to come?<\/h3>\n
Our many thanks to<\/h3>\n