gonzalo-bulnes / simple_token_authentication

Simple (and safe*) token authentication for Rails apps or API with Devise.
GNU General Public License v3.0
1.51k stars 238 forks source link

sign_in_token = true not persisting session #343

Open mrpta opened 5 years ago

mrpta commented 5 years ago

Hi there,

I'm trying to use the gem to implement a 1-click login via email.

# config/initializers/simple_token_authentication.rb
SimpleTokenAuthentication.configure do |config|

    config.sign_in_token = true

end

# app/models/user.rb
class User < ActiveRecord::Base
    acts_as_token_authenticatable
end

# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
    acts_as_token_authentication_handler_for User

    # .....

    def after_successful_token_authentication
        # Make the authentication token to be disposable
        current_user.authentication_token = nil
        current_user.save!
    end

end

A visit to http://localhost:3000/?user_email=user@example.com&user_token=zeb_htxXLs4myJR591ac goes on to load the view. However fails to correctly load anything wrapped in a user_signed_in? called in a before_action. The after_successful_token_authentication hook correctly invalidates the token so on another refresh I get directed to the the Device sign in. At first I thought the initializer was ignored but I can successfully authenticate with another field by specifying the config.identifiers. Just lacking the session persistence.

Can you give me some advice? Probably not a bug - just me being dim.