heartcombo/devise
Flexible authentication solution for Rails with Warden.
How devise is put together
Devise is a Ruby gem providing flexible, modular authentication for Rails applications, built on top of the Warden Rack middleware. It is implemented as a Rails engine exposing controllers (sessions, registrations, passwords, confirmations, unlocks, omniauth callbacks), mailers, views, routes, and model modules that host applications mix into their own models via `devise_for` route mappings. Each `devise_for` call creates a Devise::Mapping that wires a resource class to Warden strategies, controllers, and a FailureApp for failed authentication. Data flow: HTTP request -> Rails router (devise_for) -> Devise controller -> model module logic (e.g., DatabaseAuthenticatable password verification) -> Warden session management -> FailureApp redirect/recall on failure. The codebase supports both ActiveRecord and Mongoid ORMs and multiple Rails versions (7.0 through 8.x) via per-version Gemfiles.
Languages
Frameworks
Datastores
Infrastructure
Major components
Devise core (lib/devise.rb, models.rb, modules.rb)
Global configuration, module registry, mapping storage, and loading of the 10 pluggable model modules.
Mappings & routing (lib/devise/mapping.rb, lib/devise/rails/routes.rb)
Translates `devise_for` declarations into Mapping objects binding scopes to classes, controllers, paths, strategies, and the FailureApp.
Controllers (app/controllers/devise/*.rb)
Handle sign-in/out, registration, password reset, confirmation, unlock, and OmniAuth callback flows on top of the shared DeviseController base.
Model modules (lib/devise/models/*.rb)
Provide the 10 opt-in behaviors (database_authenticatable, confirmable, recoverable, registerable, rememberable, trackable, timeoutable, validatable, lockable, omniauthable) mixed into host application models.
Warden integration (lib/devise/strategies/, lib/devise/hooks/, lib/devise/rails/warden_compat.rb)
Implement Warden authentication strategies (database_authenticatable, rememberable) and after-authentication hooks (timeoutable, lockable, rememberable, csrf_cleaner, etc.).
FailureApp (lib/devise/failure_app.rb)
Rack endpoint invoked when Warden throws :warden, deciding between HTTP Basic 401, recall to a controller action, or redirect with flash messages and stored location.
Parameter sanitization & token generation (lib/devise/parameter_sanitizer.rb, lib/devise/token_generator.rb, lib/devise/encryptor.rb)
Filter permitted parameters per action, generate/digest time-limited tokens (confirmation/reset/unlock), and hash passwords (bcrypt-based Encryptor).
Generators & mailer/views (lib/generators/, app/mailers/devise/mailer.rb, app/views/devise/)
Install/model/controller/view generators for ActiveRecord and Mongoid, plus default ERB email and page templates.
No digest this week
1 weeksWeek of
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required