如何注销使用自定义设计策略登录的用户

Question

I need to logout a user that has been logged in my Rails app using custom Devise authentication strategy. This strategy is used in addition to database_authenticable strategy. Is there a logic I need to add to my custom implementation of authenticate_user! method in custom strategy? Also do I need to implement destroy method in a custom sessions controller?

Currently my custom strategy logs in the user fine (hard coded for now) but I cannot logout the user as logout action calls my custom implementation of authenticate_user! again and they are logged in again.

Answer 1

You can use skip_before_action callback in this case like in your controller put below code before all actions

 skip_before_action :authenticate_user, only: [:your_logout_action]

This will skip authentication for your method and user won't log in again.

Answer 2

So far as I understood correctly, is that, let any action to logout the current_user in devise. If it's so then it can be implemented like this

Let's say ,

class SomeController < ApplicationController
  before_action :authenticate_user!

  def some_action
    if some_logic == true #implement some_logic to return boolean(true/false)
      sign_out resource
      flash[:notice] = ''
      flash[:error] = 'You are logged out!'
      root_path
    end
  end
end

Answer 3

I was able to fix my issue. The issue was that I had hard coded valid? method to return true all the time. When I added the logic to return true only if email and password params are present then the custom auth works as expected.

Answer 4

使用户手动注销。

sign_out(current_user) if current_user.present?