{"id":365,"date":"2009-10-21T00:46:58","date_gmt":"2009-10-21T02:46:58","guid":{"rendered":"http:\/\/blog.plataformatec.com.br\/?p=365"},"modified":"2009-11-05T20:48:32","modified_gmt":"2009-11-05T22:48:32","slug":"devise-flexible-authentication-solution-for-rails","status":"publish","type":"post","link":"https:\/\/blog.plataformatec.com.br\/2009\/10\/devise-flexible-authentication-solution-for-rails\/","title":{"rendered":"Devise: flexible authentication solution for Rails"},"content":{"rendered":"

UPDATE:<\/strong> This post was an introduction to Devise and a couple of things changed since then. There is a more recent post which describes the same steps as below using generators<\/a> and, for a more complete and always updated explanation, please check the README<\/a>.<\/p>\n

In Rails Summit Latin America 2009<\/a>, we showed Devise<\/a> in a lightning talk and today we are officially releasing it! Before we show you some code, we are going to explain what we want to achieve with Devise<\/a>, starting with the most used authentication solution nowadays: Clearance<\/a> and Authlogic<\/a>.<\/p>\n

Clearance<\/h3>\n

Clearance<\/a> is a full stack authentication solution, implementing all Model, View and Controller layers using Rails Engines. It deals with account confirmation and password recovery. You just need to plug and play! However, you are required to use the model User and it does not allow you have add and\/or customize different roles.<\/p>\n

Authlogic<\/h3>\n

When comes to the Model, Authlogic<\/a> is definitely the most complete solution out there. It handles several cryptography providers and many other goodies which are completely configurable. However, it’s not a full stack solution (it does not say how users should confirm their account or recover their password) and it has a little bit of controversy since it handles the session in a model. So here is the question, where the session could be handled then?<\/p>\n

Here comes Warden!<\/h3>\n

Warden<\/a> is a general rack authentication framework, developed by Daniel Neighman<\/a>, which handles the session in a rack middleware. The main benefit from it is that you can share your authentication strategies with several apps, so if you are using Sinatra, Rails and some others middlewares at the same time, they all rely on the same rules!<\/p>\n

Devise: strategies for authentication<\/h3>\n

After we fell in love with Warden<\/a> and used it in some projects, we decided to create a full stack solution as Clearance, but flexible as Authlogic, on top of Warden<\/a>. The solution is Devise<\/a>, a Rails Engine which handles multiple roles, each one of them with different strategies. Devise currently comes with 5 strategies:<\/p>\n