Rails%203%20In%20Action

120 CHAPTER 6 Authentication and basic authorization
Table 6.1 Devise default modules (continued)
Module Provides
:trackable Adds functionality to track users, such as how many times they
sign in, when they last signed in, and the current and last IPs
they signed in from.
:validatable Validates the user has entered correct data, such as a valid
email address and password.
Table 6.2 Devise optional modules (off by default)
Module Provides
:token_authenticatable Lets the user authenticate via a token; can be used in conjunction
with :database_authenticatable
:encryptable Adds support for other methods of encrypting passwords; by
default, Devise uses bcrypt
:confirmable When users register, sends them an email with a link they click to
confirm they’re a real person (you’ll switch on this module shortly
because it’s one step to prevent automated signups)
:lockable Locks the user out for a specific amount of time after a specific
number of retries (configurable in the initializer); default is a lockout
time of 1 hour after 20 retries
:timeoutable If users have no activity in their session for a specified period of
time, they are automatically signed out; useful for sites that may
be used by multiple people on the same computer, such as email
or banking sites
:omniauthable Adds support for the OmniAuth gem, which allows for alternative
authentication methods using services such as OAuth and
OpenID
The devise call is followed by a call to attr_accessible. This method defines fields
that are accessible via attribute mass-assignment. Attribute mass-assignment happens
when you pass a whole slew of attributes to a method such as create or
update_attributes; because these methods take any and all parameters passed to
them by default, users may attempt to hack the form and set an attribute they are not
supposed to set, such as an admin boolean attribute. By using attr_accessible, you
define a white list of fields you want the user to access. Any other fields passed
through in an attribute mass-assignment are ignored.
The final step here is to run rake db:migrate to create the users table from the
Devise-provided migration in your development database and run rake
db:test:prepare so it’s created in the test database too.