Chapter 11: Authentication with Devise

So far anyone can create posts and comments on our blog. In a real application you usually want users to sign up, log in, and log out, so that only signed-in users can post. Rails does not include authentication out of the box, but the most popular solution is a gem called Devise.

In this chapter you will add Devise to the blog, create a User model, and protect your actions so only signed-in users can create posts.

🔩 Adding the Devise Gem

Open your Gemfile and add Devise:

# Gemfile
gem "devise"

Install the gem and run the Devise setup generator:

bundle install
rails generate devise:install

💾 Creating the User Model

Devise has a generator that creates a User model with everything needed for authentication:

rails generate devise User
rails db:migrate

This creates a User model with secure password handling and a migration that adds columns like email, encrypted_password, and remember/reset tokens.

🔗 Devise Routes

Open config/routes.rb and check the routes Devise created for you:

# config/routes.rb
devise_for :users

This single line gives you all the authentication routes: /users/sign_up, /users/sign_in, /users/sign_out, and more.

🔑 Protecting Actions

To require a signed-in user before creating a post, add before_action :authenticate_user! to the controller:

# app/controllers/posts_controller.rb
class PostsController < ApplicationController
  before_action :authenticate_user!, except: [:index, :show]

  # ... existing actions ...
end

Now a visitor who is not signed in will be redirected to the login page when they try to create, edit, or delete a post.

👤 Showing the Current User

Devise provides a current_user helper. You can use it in your views to show the signed-in user’s email or name:

<% if user_signed_in? %>
  <p>Welcome, <%= current_user.email %>!</p>
  <%= link_to "Sign Out", destroy_user_session_path, data: { turbo_method: :delete } %>
<% else %>
  <%= link_to "Sign In", new_user_session_path %> |
  <%= link_to "Sign Up", new_user_registration_path %>
<% end %>

🏠 Practice Exercises

# 1. Add the gem and install
gem install rails
# (add gem "devise" to Gemfile first)
bundle install
rails generate devise:install

# 2. Create the User model
rails generate devise User
rails db:migrate

# 3. Protect the posts controller
class PostsController < ApplicationController
  before_action :authenticate_user!, except: [:index, :show]
end

Now try signing up at /users/sign_up, then log in and try creating a post. Try creating a post while logged out and you will be redirected to the login page. Authentication is a huge topic, and Devise handles all the secure parts for you – passwords are hashed, sessions are managed, and reset tokens work out of the box. In the final chapter you will put everything together in a complete capstone project.