39

I am using devise gem, after clicking on the confirmation link, I want to directly sign-in. At present it is asking to sign-in again.

Recently I have added the following in the devise initialize file:

config.allow_insecure_token_lookup = true
config.secret_key = 'a8d814803c0bcc735ce657adc77793459d00154cdd7532c13d3489600dc4e963f86e14beb593a32cbe9dbbe9197c9ce50a30102f363d90350052dc8d69930033'

Any suggestions?

2
  • did your confirmation link contain any access token?
    – anon
    Commented Sep 6, 2013 at 10:19
  • 1
    yes, example link: localhost:3000/users/… Commented Sep 6, 2013 at 10:23

5 Answers 5

54

The config.allow_insecure_sign_in_after_confirmation flag is no longer supported in Devise.

While you should be aware of the possible security concerns of automatically logging users in when they confirm their account (http://blog.plataformatec.com.br/2013/08/devise-3-1-now-with-more-secure-defaults/), for some apps the benefit in terms of user experience may be worth the security tradeoff.

After all, the security risk is that a) the user mis-types their email, b) they don't immediately correct their mistake, c) the email they typed corresponds to a valid and working email, d) the person who incorrectly receives the email opens it and clicks the link.

If this is an acceptable risk profile for your application, you can override the devise ConfirmationsController:

class ConfirmationsController < Devise::ConfirmationsController
  def show
    self.resource = resource_class.confirm_by_token(params[:confirmation_token])
    yield resource if block_given?

    if resource.errors.empty?
      set_flash_message(:notice, :confirmed) if is_flashing_format?
      sign_in(resource) # <= THIS LINE ADDED
      respond_with_navigational(resource){ redirect_to after_confirmation_path_for(resource_name, resource) }
    else
      respond_with_navigational(resource.errors, :status => :unprocessable_entity){ render :new }
    end
  end
end

And route to it in your routes.rb:

devise_for :users, controllers: { confirmations: 'confirmations' }
3
  • 1
    Why can't devise do something to identify that the machine the link is being reached on, is the same machine that caused the email to be sent? Saving something in a cookie, for example. Then if the machine matches, sign in automatically, and if not, require sign in.
    – brooks
    Commented Jul 3, 2014 at 20:31
  • 3
    If you're doing this, it's worth changing the en:devise:confirmations:confirmed string in config/locales/devise.en.yml to say that you've also logged them in... Commented Mar 19, 2015 at 1:58
  • I have done something similar but just to avoid the big drawback of email change containign a typo I have allowed only freshly registered users to be signed in automatically : if (Time.now.utc - resource.created_at.utc)/3600 < 2 sign_in(resource) end
    – Maxence
    Commented Mar 15, 2019 at 11:50
16

With more recent versions of Devise, you can do the following.

config/routes.rb:

devise_for :users, controllers: { confirmations: 'users/confirmations' }

app/controllers/users/confirmations_controller.rb:

class Users::ConfirmationsController < Devise::ConfirmationsController
  def show
    super do |resource|
      sign_in(resource)
    end
  end
end
4
  • I'm fairly certain this won't actually work as intended: the yield call in Devise's ConfirmationsController happens whether or not the resource has errors, so I think that this would sign you in even without the right confirmation token (!!!). Commented Jan 8, 2015 at 5:00
  • 2
    Yes, that will sign in regardless of whether or not the token is valid. But you can remedy that by changing the sign_in line to sign_in(resource) if resource.errors.empty?
    – scottwb
    Commented Feb 7, 2015 at 7:49
  • Actually it doesn't sign the user in whether or not the token is valid. It does yield the resource, but all the fields are nil (because Devise is unable to find the User with the associated token). So you end up getting redirected to the sign_in path (by default) with a message saying you need to confirm your account. Now, with that said, I think adding the if resource.errors.empty? is nicely intention revealing, but, it is unnecessary. Commented Mar 24, 2015 at 8:42
  • Actually if resource.errors.empty? IS necessary, since without this you will be able to use confirmation token more than once (even for already confirmed account). So even after you confirm your account and set your password someone (months later?) could use old confirmation link to take over your account. In this case resigning from if resource.errors.empty? seems considerable security flaw. I even added if resource.errors.empty? && resource.encrypted_password.blank? to ensure that autologin after account confirmation is possible only for users that didn't set their password yet.
    – wrzasa
    Commented Jun 6, 2016 at 20:02
3

Looking at mb21's answer, it should be

def show
  super do |resource|
    if resource.confirmation_sent_at > DateTime.now-2.hours && resource.errors.empty?
      sign_in(resource)
    end
  end
end

confirmation_sent_at is the time the email was sent to the user, as opposed to confirmed_at, which is the moment the user clicks the link, which is always within 2 hours of now on the server when it happens...

2

Here you have how you can solve it.

This code will allow the user to automatically sign-in after confirming, only if is the first time confirming his/her account.

class ConfirmationsController < Devise::ConfirmationsController
  before_action :maybe_auto_sign_in, only: :show

  protected

  def after_confirmation_path_for(resource_name, resource)
    sign_in(resource) if @auto_sign_in
    super
  end

  private

  # Automatically sign in the user that confirmed his/her email first time.
  def maybe_auto_sign_in
    @auto_sign_in =
      User.first_time_confirming?(params[:confirmation_token])
  end
end

class User < ActiveRecord::Base
  def self.first_time_confirming?(confirmation_token)
    confirmation_token &&
      User.where(confirmation_token: confirmation_token, unconfirmed_email: nil)
          .exists?
  end
end
1

We wanted the user so sign in automatically if she clicks the link in the email 2 hours or less after user creation. Based on @Sjor's answer, we went with:

class ConfirmationsController < Devise::ConfirmationsController
  def show
    super do |resource|
      if resource.confirmed_at > DateTime.now-2.hours && resource.errors.empty?
        sign_in(resource)
      end
    end
  end
end

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.