Ror Authentication
title: Ruby on Rails Authentication — Complete Guide to Devise & Auth description: 'Learn Ruby on Rails authentication: Devise gem, user registration, login/logout, password reset, OmniAuth (Google, GitHub), session management, and authentication security.' date: 2026-06-28 lastmod: 2026-06-28 weight: 23 tags: [backend, ror]
Rails authentication verifies user identity, typically implemented with the Devise gem which provides registration, login, password recovery, and session management out of the box.
## What You'll Learn
By the end of this tutorial, you'll install and configure Devise, implement user registration and login, customize Devise views, add password reset, integrate social login with OmniAuth, and secure authentication.
## Real-World Use
A Rails app uses Devise for user accounts with email/password login, Google OAuth, password reset, account lockout after 5 failed attempts, and "remember me" cookie.
## Authentication Learning Path
```mermaid
flowchart LR
A[Forms] --> B[Authentication]
B --> C[Authorization]
C --> D[API]
D --> E[Testing]
B --> F{You Are Here}
style F fill:#f90,color:#fff
Devise Setup
# Add to Gemfile
gem "devise"
bundle install
rails generate devise:install
rails generate devise User
rails db:migrate
# config/initializers/devise.rb
Devise.setup do |config|
config.mailer_sender = "noreply@myapp.com"
config.reset_password_within = 6.hours
config.sign_out_via = :delete
config.lock_strategy = :failed_attempts
config.maximum_attempts = 5
config.unlock_strategy = :email
end
Devise Model Configuration
# app/models/user.rb
class User < ApplicationRecord
devise :database_authenticatable, :registerable,
:recoverable, :rememberable, :validatable,
:lockable, :trackable, :confirmable,
:omniauthable, omniauth_providers: [:google_oauth2, :github]
validates :username, presence: true, uniqueness: true
end
Using Devise in Controllers
class ApplicationController < ActionController::Base
before_action :authenticate_user!
end
class PostsController < ApplicationController
before_action :authenticate_user!, except: [:index, :show]
def create
@post = current_user.posts.build(post_params)
# current_user is a Devise helper
end
private
def post_params
params.require(:post).permit(:title, :body)
end
end
Devise Views
# Generate views for customization
rails generate devise:views
# Views generated in app/views/devise/
# Registrations, Sessions, Passwords, Confirmations, Unlocks
<!-- app/views/devise/sessions/new.html.erb -->
<h2>Log in</h2>
<%= form_for(resource, as: resource_name, url: session_path(resource_name)) do |f| %>
<div class="field">
<%= f.label :email %>
<%= f.email_field :email, autofocus: true, autocomplete: "email" %>
</div>
<div class="field">
<%= f.label :password %>
<%= f.password_field :password, autocomplete: "current-password" %>
</div>
<% if devise_mapping.rememberable? %>
<div class="field">
<%= f.check_box :remember_me %>
<%= f.label :remember_me %>
</div>
<% end %>
<div class="actions">
<%= f.submit "Log in", class: "btn btn-primary" %>
</div>
<% end %>
<%= render "devise/shared/links" %>
OmniAuth (Social Login)
gem "omniauth-google-oauth2"
gem "omniauth-github"
gem "omniauth-rails_csrf_protection"
bundle install
# config/initializers/devise.rb
config.omniauth :google_oauth2,
Rails.application.credentials.google[:client_id],
Rails.application.credentials.google[:client_secret]
# app/models/user.rb
def self.from_omniauth(auth)
where(provider: auth.provider, uid: auth.uid).first_or_create do |user|
user.email = auth.info.email
user.password = Devise.friendly_token[0, 20]
user.username = auth.info.name
user.skip_confirmation!
end
end
Common Mistakes
1. Not Devise's before_action
Missing before_action :authenticate_user! leaves routes unprotected. Add to ApplicationController for global auth.
2. Exposing User Passwords
Devise automatically hashes passwords. Never access user.password directly. Use has_secure_password for custom auth.
3. Weak Devise Configuration
Default Devise settings are permissive. Configure lockable, timeoutable, and password complexity for production.
4. Not Whitelisting OmniAuth Callbacks
OmniAuth callback URLs need to be whitelisted in Google/GitHub developer console.
5. Overriding Devise Controllers Without Super
When customizing Devise controllers, always call super to preserve default behavior.
Practice Questions
1. What is Devise?
A flexible authentication gem for Rails providing registration, login, password recovery, and more.
2. How do you protect a controller action with Devise?
Add before_action :authenticate_user! to the controller, or to ApplicationController for global protection.
3. What are Devise modules?
:database_authenticatable, :registerable, :recoverable, :rememberable, :validatable, :lockable, etc.
4. How do you get the currently logged-in user?
Use the current_user helper method provided by Devise.
5. Challenge: Set up Devise with Google OAuth and a customized registration form.
rails generate devise:install
rails generate devise User
rails generate devise:views
# Configure OmniAuth
# Add from_omniauth method to User model
# Add link in sign-in view: <%= link_to "Sign in with Google", user_google_oauth2_omniauth_authorize_path %>
FAQ
Mini Project: Devise Auth Setup
Install and configure Devise with user authentication and protected routes.
rails generate devise:install
rails generate devise User
rails db:migrate
# Add before_action :authenticate_user! to ApplicationController
# Add current_user helper to views
# Customize sign-in and registration views
What's Next
Ruby on Rails Authorization Ruby on Rails API
Built by the developers of DodaTech
Doda Browser, DodaZIP & Durga Antivirus Pro