Devise 3.2, Confirmation without Login, and Password Creation for New Accounts

Question

I've upgraded to Devise 3.2.1 and Rails 4.0, and I'm trying to figure out my signup now that one doesn't login on confirmation.

I allow users to create a message and specify the recipient of the message via an email address. Then I send emails notifying the recipient that they've received a message on the service. If the recipient doesn't have an account on the service, I create the account without a password, and the email I send to the recipient acts a confirmation email. With prior versions, the recipient would then click on the link, thus confirming, and then be taken to a password creation stage and then finally, they'd have a confirmed account created with password and can go see the message.

With Devise 3.1, they no longer allow login via confirmation as they consider it a security risk, however I fear it may greatly increase the complexity of my sign up process. I can no longer redirect to a password creation page as they aren't logged in. I'm toying with the idea of taking them to a special signup page or creating the account and then sending a special form of password reset.

I don't want to notify them via email, then send them a second email as a confirmation. That adds unnecessary complexity to my signup.

I wondered if anyone else has dealt with this issue and how they handled it. I'd like to avoid using:

config.allow_insecure_sign_in_after_confirmation = true

as that will go away soon and is really not the right way.

Is there a secure, yet fast way to do this with Devise 3.2?

Thanks!

Answer 1

I'm switching to using sorcery ( https://github.com/NoamB/sorcery ) for greater control over authentication and building my flow with that.

Answer 2

This is precisely the problem that devise invitable gem solves in a secure manner. I would recommend using this tool, rather than trying to hand-roll your own solution which is more likely to contain security flaws.

The gem workflow is basically:

• An admin invites a new user.
• The new user is created with a random password. (I actually helped write this bit!)
• The user is sent an invitation email. (This is fully customisable in how it works, but has some simple default settings.)
• The user receives a link, which contains a URL with a unique invitation_token.
• After clicking this link, the user must choose their real password.