HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
heartcombo
devise
Ruby2010–2026
heartcombo / devise

devise

Flexible authentication solution for Rails with Warden.

44Distinct people
46Mentions
0Explicit recommenders
24.3KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Flexible authentication solution for Rails with Warden.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 11:00:58 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year46 dated mentions

Observed mentions: 2010-05-05 02:40:10 UTC to 2026-05-29 19:54:00 UTC.

02462010-01-01 00:00:00 UTC to 2011-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20102011-01-01 00:00:00 UTC to 2012-01-01 00:00:00 UTC (exclusive): 7 mentions; 0 submissions, 7 comments2012-01-01 00:00:00 UTC to 2013-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2013-01-01 00:00:00 UTC to 2014-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 6 mentions; 0 submissions, 6 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments20182019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20102010-01-01 00:00:00 UTC2011-01-01 00:00:00 UTC101
20112011-01-01 00:00:00 UTC2012-01-01 00:00:00 UTC707
20122012-01-01 00:00:00 UTC2013-01-01 00:00:00 UTC514
20132013-01-01 00:00:00 UTC2014-01-01 00:00:00 UTC514
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC101
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC606
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC202
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC000
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC505
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC202
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC000
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC202
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC404
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC202
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC101
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC202
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC101

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
Devise is a flexible authentication solution for Rails based on Warden. It: Is Rack based; Is a complete MVC solution based on Rails engines; Allows you to have multiple models signed in at the same time; Is based on a modularity concept: use only what you really need. It's composed of 10 modules: Database Authenticatable: hashes and stores a password in the database to validate the authenticity of a user while signing in. The authentication can be done both through POST requests or HTTP Basic Authentication. Omniauthable: adds OmniAuth (https://github.com/omniauth/omniauth) support. Confirmable: sends emails with confirmation instructions and verifies whether an account is already confirmed during sign in. Recoverable: resets the user password and sends reset instructions. Registerable: handles signing up users through a registration process, also allowing them to edit and destroy their account. Rememberable: manages generating and clearing a token for remembering the user from a saved cookie. Trackable: tracks sign in count, timestamps and IP address. Timeoutable: expires sessions that have not been active in a specified period of time. Validatable: provides validations of email and password. It's optional and can be customized, so you're able to define your own validations. Lockable: locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period. Table of Contents Information The Devise wiki Bug reports StackOverflow and Mailing List RDocs Example applications Extensions Supported Ruby / Rails versions Contributing Starting with Rails? Getting started Controller filters and helpers Configuring Models Strong Parameters Configuring views Configuring controllers Configuring routes I18n Test helpers Controller tests Integration tests OmniAuth Configuring multiple models Active Job Integration Password reset tokens and Rails logs Other ORMs Rails API mode Additional information Warden License Information The Devise wiki The Devise Wiki has lots of additional information about Devise including many "how-to" articles and answers to the most frequently asked questions. Please browse the Wiki after finishing this README: https://github.com/heartcombo/devise/wiki Bug reports If you discover a problem with Devise, we would like to know about it. However, we ask that you please review these guidelines before submitting a bug report: https://github.com/heartcombo/devise/wiki/Bug-reports If you have discovered a security related bug, please do NOT use the GitHub issue tracker. Send an email to heartcombo.oss@gmail.com. StackOverflow and Mailing List If you have any questions, comments, or concerns, please use StackOverflow instead of the GitHub issue tracker: https://stackoverflow.com/questions/tagged/devise The deprecated mailing lists can still be read on: https://groups.google.com/group/plataformatec-devise https://groups.google.com/group/heartcombo RDocs You can view the Devise documentation in RDoc format here: https://rubydoc.info/github/heartcombo/devise/main/frames If you need to use Devise with previous versions of Rails, you can always run "gem server" from the command line after you install the gem to access the old documentation. Example applications There are a few example applications available on GitHub that demonstrate various features of Devise with different versions of Rails. You can view them here: https://github.com/heartcombo/devise/wiki/Example-Applications Extensions Our community has created a number of extensions that add functionality above and beyond what is included with Devise. You can view a list of available extensions and add your own here: https://github.com/heartcombo/devise/wiki/Extensions Supported Ruby / Rails versions We intend to maintain support for all Ruby / Rails versions that haven't reached end-of-life. For more information about specific versions please check Ruby and Rails maintenance policies, and our test matrix. Contributing We hope that you will consider contributing to Devise. Please read this short overview for some information about how to get started: https://github.com/heartcombo/devise/wiki/Contributing You will usually want to write tests for your changes. To run the test suite, go into Devise's top-level directory and run bundle install and bin/test. Devise works with multiple Ruby and Rails versions, and ActiveRecord and Mongoid ORMs, which means you can run the test suite with some modifiers: DEVISE_ORM and BUNDLE_GEMFILE. DEVISE_ORM Since Devise supports both Mongoid and ActiveRecord, we rely on this variable to run specific code for each ORM. The default value of DEVISE_ORM is active_record. To run the tests for Mongoid, you can pass mongoid: DEVISE_ORM=mongoid bin/test ==> Devise.orm = :mongoid When running the tests for Mongoid, you will need to have a MongoDB server (version 2.0 or newer) running on your system. Please note that the command output will show the variable value being used. BUNDLE_GEMFILE We can use this variable to tell bundler what Gemfile it should use (instead of the one in the current directory). Inside the gemfiles directory, we have one for each version of Rails we support. When you send us a pull request, it may happen that the test suite breaks using some of them. If that's the case, you can simulate the same environment using the BUNDLE_GEMFILE variable. For example, if the tests broke using Ruby 3.4 and Rails 8.0, you can do the following: chruby 3.4.0 # or rbenv shell 3.4.0, or rvm use 3.4.0, etc. BUNDLE_GEMFILE=gemfiles/Gemfile-rails-8-0 bundle install BUNDLE_GEMFILE=gemfiles/Gemfile-rails-8-0 bin/test You can also combine both of them if the tests broke for Mongoid: BUNDLE_GEMFILE=gemfiles/Gemfile-rails-8-0 bundle install BUNDLE_GEMFILE=gemfiles/Gemfile-rails-8-0 DEVISE_ORM=mongoid bin/test Running tests Devise uses minitest as test framework. Running all tests: bin/test Running tests for an specific file: bin/test test/m
Read the full README on GitHub

What Hacker News says

5 sources
I also wondered whether Devise handled this issue and looked at the source. Devise doesn't address this issue. It relies on warden underneath and serializes the user into the session without any sort of expiry (https://github.com/plataformatec/devise/blob/master/lib/devi...). There are a lot of options for remediation, though, like overriding the aforementioned serialization hash to attach an expiry, or setting an expiry in a separate key in the session.
In Logout is broken by default in Ruby on Rails Web applications
We're tracking Rails 4 compatibility for the major gems we use, based on a bit of skimming GitHub Issues and Pull Requests. Here are the highlights from that list: CanCan[1] has a '2.0' branch where Rails 4 support is being worked on. It also has PR #838 open for supporting strong_parameters in the current stable 1.6 tree. Devise[2] pushed 3.0.0.rc about a month ago with Rails 4 support. FriendlyId[3] seems to have work in progress on their master branch. Acts-as-taggable-on[4] states in their README that they are compatible in version 2.4.1, but there seem to be a couple open issues related to Rails 4. edit: formatting [1]: https://github.com/ryanb/cancan/ [2]: https://github.com/plataformatec/devise/ [3]: https://github.com/FriendlyId/friendly_id [4]: https://github.com/mbleigh/acts-as-taggable-on
In If Your Business Uses Rails 2.3 You Need To Move To A Supported Option ASAP
Most people used canned packages in Rails with something like Devise. Looking at the source it looks like the token is pulled right off the params: https://github.com/plataformatec/devise/blob/master/app/cont... The reset routine uses Rails finder mechanism to do just what the OP discusses: https://github.com/plataformatec/devise/blob/master/lib/devi... I don't use MySQL because for reasons just like this - so I'm not all that surprised. That said - it would be interesting to see Devise put to the test to see if it is indeed a problem for Devise. This is not, however, a Rails issue.
In MySQL madness and Rails (+possible exploit)

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.