search

wmlele / devise-otp

Two Factors authentication for Devise using Time Based OTP/rfc6238 tokens.
MIT License
210 stars 40 forks source link

Fix issue with scoped redirects for non-default resources #88

Closed strouptl closed 2 months ago

strouptl commented 2 months ago

@paweld-iRonin discovered an issue (#86) where the non-default resource was being redirected to the default resource's routes within the otp_tokens_controller. The underlying problem is that simply calling "redirect_to :show" in the otp_tokens_controller redirects to the default scope, rather than getting the proper scope for that resource.

This issue is a hold over from before, when we were only using one resource, and it was not reflected in tests, as the user scope is the default anyway. However, it can be reproduced by reversing the order of the "devise_for" additions for users and admins in the routes file of the test app.

This PR resolves the immediate issue, along with the attendant "Disable OTP" link issue.

strouptl commented 2 months ago

@strzibny, I made one more commit, reversing the order of the admin and user routes in the test app. This will eliminate false positives in the tests from the default (user) routes like this going forward.

strzibny commented 2 months ago

Thank you!