Rails Authentication

Implement Devise for user login.

A practical Rails reference for adding Devise, generating the user model, protecting controllers, and wiring sign-in links into the layout.

Start Setup Protect Pages

Setup

Add Devise to a Rails app.

Install Devise

Add the gem, install it, and generate the Devise initializer.

bundle add devise

Adds Devise to the Gemfile and installs it.

bin/rails generate devise:install

Creates config/initializers/devise.rb and setup notes.

Configure Mailer Defaults

Devise sends confirmation, unlock, and password reset links through your app mailer.

config.action_mailer.default_url_options = { host: "localhost", port: 3000 }

Use this in config/environments/development.rb.

config.action_mailer.default_url_options = { host: "example.com" }

Use your production domain in config/environments/production.rb.

Create the User Model

Generate the Devise model that will own email, encrypted password, reset tokens, and session behavior.

bin/rails generate devise User

Creates app/models/user.rb, a migration, and routes.

bin/rails db:migrate

Applies the users table migration.

Protect Pages

Require login before users can access private controllers.

before_action :authenticate_user!

Place this in a controller that needs authentication.

current_user

Use this helper to access the signed-in user.

user_signed_in?

Use this helper to check whether a user is logged in.

User Model

Choose the modules your app needs.

The generated model includes common modules. Add stricter modules only when the app needs that behavior.

database_authenticatable

Stores an encrypted password and validates login credentials.

registerable

Lets users sign up, edit, and cancel their account.

recoverable

Adds forgot-password and reset-password flow.

rememberable

Keeps users signed in with a remember-me cookie.

validatable

Adds basic email and password validations.

confirmable

Requires email confirmation before login.

lockable

Locks an account after too many failed attempts.

trackable

Tracks sign-in count, timestamps, and IP addresses.

Example model

class User < ApplicationRecord
  devise :database_authenticatable, :registerable,
         :recoverable, :rememberable, :validatable
end

Controller and Layout

Require login and show session actions.

app/controllers/application_controller.rb

before_action :authenticate_user!

app/controllers/admin/dashboard_controller.rb

before_action :authenticate_user!

app/views/layouts/application.html.erb

<% if user_signed_in? %>
  <%= button_to "Sign out", destroy_user_session_path, method: :delete %>
<% else %>
  <%= link_to "Sign in", new_user_session_path %>
<% end %>

Helpful routes after generation

Devise adds paths like new_user_session_path, destroy_user_session_path, new_user_registration_path, and edit_user_registration_path.

Final Checklist

Gem is installed and devise:install has run.

Mailer default_url_options is configured.

User model was generated and migrated.

Private controllers use authenticate_user!.

Navigation has sign in and sign out actions.

Password reset email works in development and production.