devise-confirmable – Tarik Billa

Avoid sign-in after confirmation link click using devise gem?

August 14, 2023 by Tarik

The config.allow_insecure_sign_in_after_confirmation flag is no longer supported in Devise. While you should be aware of the possible security concerns of automatically logging users in when they confirm their account (http://blog.plataformatec.com.br/2013/08/devise-3-1-now-with-more-secure-defaults/), for some apps the benefit in terms of user experience may be worth the security tradeoff. After all, the security risk is that a) the … Read more

Devise “Confirmation token is invalid” when user signs up

June 6, 2023 by Tarik

So upgrading to Devise 3.1.0 left some ‘cruft’ in a view that I hadn’t touched in a while. According to this blog post, you need to change your Devise mailer to use @token instead of the old @resource.confirmation_token. Find this in app/views/<user>/mailer/confirmation_instructions.html.erb and change it to something like: <p>Welcome <%= @resource.email %>!</p> <p>You can confirm … Read more