Kotlin, Java, Python, C#, Typescript. Anything that has a trustworthy and consistent pointer between code.
Ruby would be the one exception I’ve worked on in my head, and for they language, ctrl+f *usually* (but not always) finds the rest.
Ruby is particularly magical with being able to evaluate methods from dynamic strings into running, production code[0]; but otherwise, languages and capable IDEs, like IntelliJ and Visual Studio just support that. I don’t happen to use VS Code, but I assume it has basic refactor, too.
[0] Devise. https://github.com/heartcombo/devise/blob/main/lib/devise/co...
In We should be more tired than the modelheartcombo
devise
Ruby2010–2026
heartcombo / devise
devise
Flexible authentication solution for Rails with Warden.
44Distinct people
46Mentions
0Explicit recommenders
24.3KGitHub stars
What to know before exploring
What it is
Flexible authentication solution for Rails with Warden.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- binarylogic/authlogic · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year46 dated mentions
Observed mentions: 2010-05-05 02:40:10 UTC to 2026-05-29 19:54:00 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2010 | 2010-01-01 00:00:00 UTC | 2011-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2011 | 2011-01-01 00:00:00 UTC | 2012-01-01 00:00:00 UTC | 7 | 0 | 7 |
| 2012 | 2012-01-01 00:00:00 UTC | 2013-01-01 00:00:00 UTC | 5 | 1 | 4 |
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 5 | 1 | 4 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 6 | 0 | 6 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 1 | 0 | 1 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Devise is a flexible authentication solution for Rails based on Warden. It:
Is Rack based;
Is a complete MVC solution based on Rails engines;
Allows you to have multiple models signed in at the same time;
Is based on a modularity concept: use only what you really need.
It's composed of 10 modules:
Database Authenticatable: hashes and stores a password in the database to validate the authenticity of a user while signing in. The authentication can be done both through POST requests or HTTP Basic Authentication.
Omniauthable: adds OmniAuth (https://github.com/omniauth/omniauth) support.
Confirmable: sends emails with confirmation instructions and verifies whether an account is already confirmed during sign in.
Recoverable: resets the user password and sends reset instructions.
Registerable: handles signing up users through a registration process, also allowing them to edit and destroy their account.
Rememberable: manages generating and clearing a token for remembering the user from a saved cookie.
Trackable: tracks sign in count, timestamps and IP address.
Timeoutable: expires sessions that have not been active in a specified period of time.
Validatable: provides validations of email and password. It's optional and can be customized, so you're able to define your own validations.
Lockable: locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.
Table of Contents
Information
The Devise wiki
Bug reports
StackOverflow and Mailing List
RDocs
Example applications
Extensions
Supported Ruby / Rails versions
Contributing
Starting with Rails?
Getting started
Controller filters and helpers
Configuring Models
Strong Parameters
Configuring views
Configuring controllers
Configuring routes
I18n
Test helpers
Controller tests
Integration tests
OmniAuth
Configuring multiple models
Active Job Integration
Password reset tokens and Rails logs
Other ORMs
Rails API mode
Additional information
Warden
License
Information
The Devise wiki
The Devise Wiki has lots of additional information about Devise including many "how-to" articles and answers to the most frequently asked questions. Please browse the Wiki after finishing this README:
https://github.com/heartcombo/devise/wiki
Bug reports
If you discover a problem with Devise, we would like to know about it. However, we ask that you please review these guidelines before submitting a bug report:
https://github.com/heartcombo/devise/wiki/Bug-reports
If you have discovered a security related bug, please do NOT use the GitHub issue tracker. Send an email to heartcombo.oss@gmail.com.
StackOverflow and Mailing List
If you have any questions, comments, or concerns, please use StackOverflow instead of the GitHub issue tracker:
https://stackoverflow.com/questions/tagged/devise
The deprecated mailing lists can still be read on:
https://groups.google.com/group/plataformatec-devise
https://groups.google.com/group/heartcombo
RDocs
You can view the Devise documentation in RDoc format here:
https://rubydoc.info/github/heartcombo/devise/main/frames
If you need to use Devise with previous versions of Rails, you can always run "gem server" from the command line after you install the gem to access the old documentation.
Example applications
There are a few example applications available on GitHub that demonstrate various features of Devise with different versions of Rails. You can view them here:
https://github.com/heartcombo/devise/wiki/Example-Applications
Extensions
Our community has created a number of extensions that add functionality above and beyond what is included with Devise. You can view a list of available extensions and add your own here:
https://github.com/heartcombo/devise/wiki/Extensions
Supported Ruby / Rails versions
We intend to maintain support for all Ruby / Rails versions that haven't reached end-of-life.
For more information about specific versions please check Ruby
and Rails maintenance policies, and our test matrix.
Contributing
We hope that you will consider contributing to Devise. Please read this short overview for some information about how to get started:
https://github.com/heartcombo/devise/wiki/Contributing
You will usually want to write tests for your changes. To run the test suite, go into Devise's top-level directory and run bundle install and bin/test.
Devise works with multiple Ruby and Rails versions, and ActiveRecord and Mongoid ORMs, which means you can run the test suite with some modifiers: DEVISE_ORM and BUNDLE_GEMFILE.
DEVISE_ORM
Since Devise supports both Mongoid and ActiveRecord, we rely on this variable to run specific code for each ORM.
The default value of DEVISE_ORM is active_record. To run the tests for Mongoid, you can pass mongoid:
DEVISE_ORM=mongoid bin/test
==> Devise.orm = :mongoid
When running the tests for Mongoid, you will need to have a MongoDB server (version 2.0 or newer) running on your system.
Please note that the command output will show the variable value being used.
BUNDLE_GEMFILE
We can use this variable to tell bundler what Gemfile it should use (instead of the one in the current directory).
Inside the gemfiles directory, we have one for each version of Rails we support. When you send us a pull request, it may happen that the test suite breaks using some of them. If that's the case, you can simulate the same environment using the BUNDLE_GEMFILE variable.
For example, if the tests broke using Ruby 3.4 and Rails 8.0, you can do the following:
chruby 3.4.0 # or rbenv shell 3.4.0, or rvm use 3.4.0, etc.
BUNDLE_GEMFILE=gemfiles/Gemfile-rails-8-0 bundle install
BUNDLE_GEMFILE=gemfiles/Gemfile-rails-8-0 bin/test
You can also combine both of them if the tests broke for Mongoid:
BUNDLE_GEMFILE=gemfiles/Gemfile-rails-8-0 bundle install
BUNDLE_GEMFILE=gemfiles/Gemfile-rails-8-0 DEVISE_ORM=mongoid bin/test
Running tests
Devise uses minitest as test framework.
Running all tests:
bin/test
Running tests for an specific file:
bin/test test/m
Read the full README on GitHubWhat Hacker News says
46 sourcesTo add, the above code is a pretty near approximation of the literal code inside the devise codebase, which is a very standard Ruby auth system.
See here:
https://github.com/heartcombo/devise/blob/main/lib/devise/co...
def self.define_helpers(mapping) #:nodoc:
mapping = mapping.name
class_eval <<-METHODS, __FILE__, __LINE__ + 1
def authenticate_#{mapping}!(opts = {})
That code is *literally* calling class_eval with a multi-line string parameter, where it inlines the helper name (like admin, user, whatever), to grow the class at runtime.
It hurts my soul.
In We fell out of love with Next.js and back in love with Ruby on RailsAcknowledging that I haven't had a chance to try the new Rails 8 auth stack... over the last decade I've gone from being a Devise hater to a Devise lover.
Yes, it can seem esoteric and magical (in the bad way) until you wrap your head around the idioms and design philosophy. There's a lot of functionality that happens unless you override it. I fully get that this rubs a lot of people who aren't in the pool the wrong way.
However, in addition to the impressive selection of modular capabilities mentioned elsewhere in this thread, there's a very bright light that goes on when you realize that you can make powerful changes to the way the library works by reopening a few controller classes and defining your own methods.
My strong advice for anyone looking at Devise and perhaps feeling stumped is to open up https://github.com/heartcombo/devise/
Read the rest
tree/main/app/controlle... and spend some tens of minutes looking at how the library does what it does. These controller - especially sessions and registrations - contain all of the business logic driving the "magic". Not only do they reveal themselves as relatively simple and well thought out, all of those yield calls mean that you can call those methods while passing a block to them. Whatever is in that block will be evaluated inside of that method when it runs.
The people who designed Devise put a lot of thought into this stuff. When you get it, you suddenly don't want to be without it.
IMHO the stateful opaque token approach is simple enough that it can (and often does) get baked into whatever language/framework you’re using to write your app. In addition, the very nature of session tokens is such that the logic for what the token actually means/represents lives in your app, on the server.
So, that may be why we don’t see more “opaque session token” standards/libraries out there as an alternative to JWTs.
But if you want an existing example, Devise for Rails [1] has been around a while.
[1] https://github.com/heartcombo/devise
In Should I use JWTs for authentication tokens?Not sure everywhere else, but within the Ruby community the ‘devise’ gem is most popular auth plugin.
Discussion are currently underway as to how to refactor the code to make passwords second class citizens. And further whether to factor in design for MFA or just to bypass straight to adding passkey support.
It’s major replumbing to essentially move username/password to be one of many, within the auth framework.
Once this is resolved in devise thousands of Ruby/rails apps could add support overnight, but it seems to be getting a little stuck on the question of the best way forward (and someone to do all that heavy lifting).
Join the conversation if you have something valuable to add:
https://github.com/heartcombo/devise/issues/5527
In Ask HN: Why is WebAuthn so slow to take off?And for reference, the gold standard, Devise: https://github.com/heartcombo/devise
In Rails authentication from scratchRuby on Rails https://rubyonrails.org/ seems to meet all of these requirements:
- ActiveRecord is wonderful for data schemas: https://guides.rubyonrails.org/active_record_migrations.html
- ActiveRecord form validations is excellent and defined only on the model
- Scaffolds automatically generate create/read/update/delete endpoints: https://guides.rubyonrails.org/v3.2/getting_started.html#get...
- Websocket-driven updates provided by Hotwire / Turbo Streams: https://turbo.hotwired.dev/handbook/introduction
- Authorization and Authentication by Devise: https://github.com/heartcombo/devise
HAML is wonderful as a templating language as well.
In Ask HN: Hunting for a FrameworkI've always found heartcombo/devise's wiki to be a really easy read. I recall it was very helpful without too much info when I was just getting started. https://github.com/heartcombo/devise/wiki/How-Tos.
In Ask HN: Best and Worst API Documentations?For speed I'd look at Ruby on Rails.
The way it's been explained to me, Rails packages (gems) are like prefab bathrooms and kitchens. Compared to e.g., Node.js packages which provide things like "sink" and "tap" and "door handle."
E.g., in Rails there's a popular auth package that includes password reset and recovery functionality:
https://github.com/heartcombo/devise
Always a pain to build, and not something these popular Node.js packages save you from doing over and over again:
http://www.passportjs.org/
https://next-auth.js.org/
EDIT: It sounds like I'm picking on those packages. I don't mean to, just want to highlight the difference in philosophy between the Node.js and Rails approaches.
In Ask HN: In 2022 how do you develop a simple CRUD app if you have few time?I don't think the Rails Guides mention Devise, the authentication gem, which is pretty important if you want create a public facing website with users. The devise documentation is pretty good though. Again, a little bit of a learning curve, but once you learn it you can add user authentication to your site pretty quickly.
https://github.com/heartcombo/devise#getting-started
In Don't make me think, or why I switched to Rails from JavaScript SPAsOk, so first of all, I'd strongly advise you not to use tabs for Ruby, just because it's a community very heavily based on stylistic consistency, and the community is very much on the side of spaces (see https://ukupat.github.io/tabs-or-spaces/).
For one example of something that wouldn't work with tabs (although not my original point, see the whitespace between `key:` and `key,` on line 66 here: https://github.com/rails/rails/blob/main/actionmailbox/app/c...
For an example closer to my original point, see line 13 here: https://github.com/heartcombo/devise/blob/master/app/control...
In Developers Who Use Spaces Make More Money Than Those Who Use Tabs (2017)I'm using Rails Devise[1] for user auth, and http basic auth for RSS. RSS Basic auth credentials are always auto-generated, and don't give access to anything other than fetching the RSS feed.
Rails uses the "master key" to let you check in encrypted database credentials. I don't use that but Rails still requires a key for deployment--so I just checked in a key. Rails is really designed for a codebase that matches to a single deployment so this is a bit of a workaround.
[1] https://github.com/heartcombo/devise
In Show HN: Haven – Run a private website to share with only the people you chooseDevise[1] alone makes it worth using rails for many webapps. Throw in things like simple form[2] and will paginate[3] and it's incredible how much you can get done cleanly and quickly. Using something like intercooler.js, you can build a solid modern web app in a fraction of the complexity of most systems today.
1 - https://github.com/plataformatec/devise
2 - https://github.com/plataformatec/simple_form
3 - https://github.com/mislav/will_paginate
In Choosing Ruby on Rails for web development project in 2019Rails doesn't include Auth.
Devise does a great job of it though - https://github.com/plataformatec/devise
In Ruby in Twenty Minutes (2006)Auth isn't rocket science - I'd encourage people to recommend well-guided DIY here for newer developers in a lot of cases, because foundational tech learning experiences are critical to growing as a developer.
There's value to many in SaaS offerings, but any decently-sized programming ecosystem has a crap ton of auth offerings. e.g. Devise [0], Dotnet Identity [1], Django Auth [2]. Authorization is the fiddly/annoying part. For authentication, a reasonably motivated developer can expect to have workable, secure password authentication going in a couple hours, as long as they don't try to invent their own encryption scheme.
[0]: https://github.com/plataformatec/devise
[1]: https://docs.microsoft.com/en-us/aspnet/core/security/authen...
[2]: https://docs.djangoproject.com/en/2.1/topics/auth/
In Ask HN: What do you use for authentication and authorization?Showing the 15 most recent of 46 sources. Enable JavaScript to search and browse every indexed mention.