Devise Github project page: https://github.com/plataformatec/devise

After some google searching I arrived at the decision to use Devise over Authlogic for my brand spanking new rails 3 app. I haven’t really had that much experience with authlogic in the past, besides using it in my previous rails 3 app. It was a little tricky to get it working with rails 3 and I wasn’t the biggest fan of the documentation (I felt it could have been a little more granular). That being said I have never used Devise but the yammering on the internet suggests it is a cleaner solution and works out of the box with rails 3. (http://stackoverflow.com/questions/4136121/rails-3-authentication-authlogic-vs-devise) I also liked some of the out of the box features it came with:

• Database Authenticatable: encrypts and stores a password in the database to validate the authenticity of an user while signing in. The authentication can be done both through POST requests or HTTP Basic Authentication.
• Token Authenticatable: signs in a user based on an authentication token (also known as “single access token”). The token can be given both through query string or HTTP Basic Authentication.
• Confirmable: sends emails with confirmation instructions and verifies whether an account is already confirmed during sign in.
• Recoverable: resets the user password and sends reset instructions.
• Registerable: handles signing up users through a registration process, also allowing them to edit and destroy their account.
• Rememberable: manages generating and clearing a token for remembering the user from a saved cookie.
• Trackable: tracks sign in count, timestamps and IP address.
• Timeoutable: expires sessions that have no activity in a specified period of time.
• Validatable: provides validations of email and password. It’s optional and can be customized, so you’re able to define your own validations.
• Lockable: locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.
• Encryptable: adds support of other authentication mechanisms besides the built-in Bcrypt (the default).

The Exploration

First things first, add “devise” to your rails Gemfile in the root directory of your application.
Note: this example assumes knowledge of the bundler gem

Running bundle install will set you up with:

Following the install docs on the Devise project page..

Alright, based on the install output it looks like we need to do a little setup work… However, I will leave that to the reader since they may be using a pre-existing rails application…

After you are finished configuring the application its time to create your user model.

Great, lets take a look at what the generator created starting with the migration.

It looks like Devise gives you password encryption/storing, password recovery, session tokens, and login attempts by default. For my application I will also uncomment the lines for Confirmable, Lockable and Token authenticatable since I find these registration options useful out of the box and will save me time from writing those components later.

The only thing I needed to investigate of these options was the Lockable option since I wanted to understand the lock and unlock strategies.

Alright, now that we understand what they mean here is what my final migration looks like:

Now let’s take a look at our User model.

It looks like based on our migration options that we will also have to uncomment token_authenticatable, :confirmable, :lockable and :timeoutable and add it to the devise option.

We don’t need to setup our routes for user because devise has already added devise_for :users to our config/routes.rb for us. If we then run rake routes from the command line we get:

Finally it’s time to migrate our database and create our user model.

Now it’s time to start our rails server and see what devise has given us. Run rails server from the command line and lets travel to “localhost:3000/users/sign_up” and see whats going on.

My first thoughts are “Wow, that’s kind of ugly”. haha. Looks like down the line I will have to override those views and build custom ones (by overriding the routes!). I then attempt to sign up by filling out the form. The page reloads and tells me “You have signed up successfully. If enabled, a confirmation was sent to your e-mail.”. Yay, alright now I realize immediatly that I haven’t yet setup an smtp server on my local machine however if we check the server output or logs we will see a generated message:

Fantastic if we go to the confirmation address http://localhost:3000/users/confirmation?confirmation_token=wYQlv1D1lbB9InFq8dVZ we should be able to active our new account and sure enough the confirm works and sends us to the homepage with the message ‘Your account was successfully confirmed. You are now signed in.’

Conclusion

Devise is easy to setup and install using Rails 3. It give me the flexibility and features I need to fulfill the authentication requirements of my application. Good documentation and setup instructions go a long way. We will see with time if I regret my decision. If anyone out there in the internets know of any helpful information that would be beneficial to this blog post please comment below!

Update

To update your Devise views run this from the command line:

This will pull the views from the gem and allow you to modify them.