设计显示用户已通过密码重置登录，

Question

I am using devise plugin for resetting the user password, i have this problem, so the scenario is like , when i send link for resetting the password it lands to a custom reset page, which have view for resetting the password , but the weird thing the user is already logged in , when it lands to that page, if i click on main tab without resetting the password, i can navigate like i am already logged in.

How can i make sure that user should not be already logged in, once i reset the password then it should login again to use the account.

Answer 1

Maybe you missing this line in your controller:

before_action :authenticate_user! except: :change_password

This will not login the user for that particular controller action.

Note that change_password will be the name of your controller action for changing the password.

Answer 2

Unexpected login sometimes happen if routes.rb allows two different signin path when different user models are used.

Run rake routes and check if there is new_user_session_path along with, for example, new_buyer_session_path .

If there is, fixing your routes might solve your problem.