使用Devise自定义认证失败逻辑与特殊接口认证处理方法咨询

Hey there! Let's tackle your two Devise authentication questions with practical, actionable solutions:

Devise relies on Warden under the hood to handle authentication failures, so you have a couple of flexible ways to tweak this behavior:

Option 1: Build a Custom Failure App (Global Scope) #

This is perfect if you want consistent custom handling across your entire app.

1. First, create a custom failure class that inherits from Devise::FailureApp (drop this in app/lib/custom_failure.rb):

class CustomFailure < Devise::FailureApp
  def respond
    # Tailor responses based on request type (JSON for APIs, HTML for web)
    if request.format.json?
      json_error_response
    else
      # Fall back to Devise's default behavior for non-API requests
      super
    end
  end

  private

  def json_error_response
    self.status = 401
    self.content_type = 'application/json'
    self.response_body = { 
      error: 'Authentication Failed', 
      message: 'Invalid email or password provided' 
    }.to_json
  end
end

2. Update your Devise initializer (config/initializers/devise.rb) to use this custom failure app:

Devise.setup do |config|
  # ... other existing configs ...
  config.warden do |manager|
    manager.failure_app = CustomFailure
  end
end

Option 2: Override authenticate_user! in Specific Controllers #

If you only need custom handling for a subset of controllers (like your API controllers), override the authenticate_user! method directly:

class Api::BaseController < ApplicationController
  protected

  def authenticate_user!
    unless user_signed_in?
      respond_to do |format|
        format.json do
          render json: { error: 'Unauthorized Access' }, status: :unauthorized
        end
        format.html do
          redirect_to new_user_session_path, alert: 'Please log in to continue'
        end
      end
    end
  end
end

For your requirement—returning 401 for most endpoints but continuing processing (with a unique response) for one special endpoint—you’ll want to override the authenticate_user! method in your API controller and use Warden's custom_failure! method to bypass the default 401 response for that specific action.

Here’s a concrete implementation:

class Api::YourController < Api::BaseController
  # Apply authentication to all actions (we'll handle the special one manually)
  before_action :authenticate_user!

  protected

  def authenticate_user!
    unless user_signed_in?
      # Check if we're hitting the special endpoint (replace with your action name)
      if action_name == 'special_endpoint'
        # Tell Warden not to trigger the default failure behavior
        warden.custom_failure!
        # Set a flag to track authentication failure for later use
        @auth_failed = true
      else
        # For all other endpoints, use the default 401 handling
        super
      end
    end
  end

  # Your special endpoint action
  def special_endpoint
    if @auth_failed
      # Return your custom response body here (adjust status code if needed)
      render json: { 
        status: 'unauthenticated', 
        message: 'Request processed, but authentication credentials were invalid' 
      }, status: 200
    else
      # Normal logic for authenticated users
      render json: { data: 'Your protected content goes here' }
    end
  end
end

The warden.custom_failure! call is critical here—it tells Warden to skip the default failure redirect/response and let the request proceed to your action, where you can return the unique response body you need.

内容的提问来源于stack exchange，提问作者Travis