:require_no_authentication filter when reset user password

Question

I have trouble with password resetting in my application. On clicking "Reset password" button, I get an email "Reset password instructions" with link to "Reset password".

When signed in - If I click on reset password link from the email, it is redirected to root path, not password reset page.

When logged out - After logging out from my app, and then click on reset password link from the email, it redirects to edit password page.

Following this instructions - (https://github.com/plataformatec/devise/wiki/How-To:-Redirect-URL-after-sending-reset-password-instructions)

Passwords controller:

class Users::PasswordsController < Devise::PasswordsController

  protected

  def after_sending_reset_password_instructions_path_for(resource_name)
    edit_user_registration_path
  end

end

config/routes.rb:

devise_for :users, controllers: { passwords: 'passwords' }

But still getting the same error. Console log:

Started GET "/users/password/edit?reset_password_token=[FILTERED]" for 127.0.0.1 at 2019-04-09 13:59:26 +0300
Processing by Users::PasswordsController#edit as HTML
  Parameters: {"reset_password_token"=>"[FILTERED]"}
  User Load (0.3ms)  SELECT  "users".* FROM "users" WHERE "users"."id" = $1 ORDER BY "users"."id" ASC LIMIT $2  [["id", 10], ["LIMIT", 1]]
  ↳ /home/anatoly/.rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/activerecord-5.2.1/lib/active_record/log_subscriber.rb:98
Redirected to http://localhost:3000/
Filter chain halted as :require_no_authentication rendered or redirected
Completed 302 Found in 2ms (ActiveRecord: 0.3ms)

Can anyone help me?

Thank you in advance!

Thank you! I have already add this functionality to my app. My question was about resetting password by admin and then set new password by user. (as wanted my employer). I have solved this problem too. I just added skip_before_action :require_no_authentication to PasswordsController.rb. — Anatolii Stupin

daniloisr daniloisr · Accepted Answer · 2019-04-09T14:41:12

This behavior is correct.

The "Reset password" page is used only to recover the password, so if the user is already logged the page isn't shown. Logged users can use the route /users/edit to edit their password.

Here is how Devise's recover password controller prevent logged user from accessing the "Reset Password" page:

controllers/devise/passwords_controller.rb#L4
- Calls require_no_authentication
devise_controller.rb#L114-L116
- Detects the logged user and redirects to after_sign_in_path_for path

:require_no_authentication filter when reset user password

1 Answers