Rails 5：禁用对Devise注册和登录表单页面的访问

Question

I have Devise and OmniAuth-Twitter setup. I used to use email signup with Devise, then I switched to Twitter login. Now I need to disable email sign up and sign in access for everyone.

http://localhost:3000/register
http://localhost:3000/login

I tried the code below in views, but I get error. I assume because of it being an ActiveRecord feature.

redirect_to root_path

and I couldn't redirect in Controller as before_action: since I do not have controller for Devise.

What is best way to disable access to this register and login pages?

Thank you!

Answer 1

If you really want to redirect from the login and registration pages, you should create two controllers that extend Devise::SessionsController and Devise::RegistrationsController and then configure your routes to use your controllers instead of the default controllers that Devise uses.

Here's an example for the login path only, but it's the same logic for registrations.

# config/routes.rb
devise_for :users, controllers: { sessions: 'users/sessions' }

# app/controllers/users/sessions_controller.rb
module Users
  class SessionsController < Devise::SessionsController
    def new
      # Redirect wherever you want here
      redirect_to root_path
    end
  end
end

Please note that devise allows you to skip some routes as well, but keep in mind that the whole controller will be excluded, which might not be what you want.

# config/routes.rb
devise_for :users, only: [:passwords]
# or
devise_for :users, skip: [:sessions]

Answer 2

It's not necessarily that you need controller logic, it's that you need to block that ability from the view side. You have appname/app/views/devise/registrations/new.html.erb and appname/app/views/devise/sessions/new.html.erb that you need to modify to remove the form fields that you want to hide and also delete stuff from your appname/app/views/devise/shared/_links.html.erb as well to disallow the signup there too.

You're going to want to delete the code that looks like lines 8-10 and lines 12-14 in your shared _links.html.erb file.

1 <%- if devise_mapping.omniauthable? %> 
2   <%- resource_class.omniauth_providers.each do |provider| %> 
3     <div class="twitter-button"> 
4     <%= link_to "Sign in with #{OmniAuth::Utils.camelize(provider)}", omniauth_authorize_path(resource_name, provider), class: "twitter-text" %> 
5     </div> 
6   <% end -%> 
7 <% end -%> 
8 <%- if controller_name != 'sessions' && false %> 
9   <%= link_to "Log in", new_session_path(resource_name), class: "forget" %> 
10 <% end -%> 
11 

12 <%- if devise_mapping.registerable? && controller_name != 'registrations' && false %> 
13   <%= link_to "Sign up", new_registration_path(resource_name), class: "forget" %> 
14 <% end -%> 

But, at the end of the day I don't think it's necessarily a great idea to completely disallow people that don't have a twitter to utilize your app, because it greatly reduces the number of people that can now use your app right off the bat.