Where to override current_user helper method of devise gem

Question

How can i override current_user of devise gem. Actually I need to add web services for mobile-app.

Currently devise is managing session and 'current_user' for web-application.

Now Mobile app will send user_id to the server. I need to override current user like this

def current_user
  if params[:user_id].blank?
    current_user
  else
    User.find(params[:user_id])
  end   
end

Should I need to modify devise gem as plugin ? or something else ?
Kindly explain in detail as I am new in rails.

Kind regards,

yikes... so, are you saying when a mobile agent sends up a user_id you'll just trust it? — Mark Nadig, Apr 27 '12 at 16:18
Devise will handle that token_authenticatable - just passing authentication_token up, no need for user_id. — Mark Nadig, Apr 30 '12 at 16:01

score 59 · Accepted Answer · edited Oct 01 '19 at 09:48

59

According to the module Devise::Controllers::Helpers, current_user (together with all other devise helpers) is added to ApplicationController, which means that you can override it in this way:

# in application_controller.rb

def devise_current_user
  @devise_current_user ||= warden.authenticate(scope: :user)
end

def current_user
  if params[:user_id].blank?
    devise_current_user
  else
    User.find(params[:user_id])
  end   
end

edited Oct 01 '19 at 09:48

Sagar Ranglani

5,491
4
34
47

answered Apr 27 '12 at 11:36

Limbo Peng

2,485
19
12

8

Error on the "alias_method" row: undefined_method 'current_user' for class ApplicationController (NameError), when starting up my environment. If I comment it out, boot up, and uncomment, it works fine. Got a fix? – Frexuz Oct 31 '12 at 18:26
6

Frexuz, try replacing the alias_method with something like: def devise_current_user { @devise_current_user ||= warden.authenticate(:scope => :user) } – Doug English Mar 16 '13 at 04:37
is this thread-safe? I'm getting nil errors in weird points in controllers after authentication on MRI. – John Smith Apr 12 '14 at 01:24
3

why alias current_user instead of calling super? – Bryan May 05 '14 at 02:19
1

`alias_method` is better than calling `super` in case you'd actually need to acccess the original `current_user`. You may need it at some point (eg. `if current_user != devise_current_user #etc.`). – Augustin Riedinger Sep 21 '15 at 10:24
What for @devise_current_user? What is that? – Johan Donado B. Jun 12 '22 at 06:02

score 6 · Answer 2 · answered Sep 02 '14 at 22:52

The other answer suggesting aliasing the method is actually not the best solution. Doug English's comment is the best solution:

# In ApplicationHelper
def devise_current_user
   @devise_current_user ||= warden.authenticate(:scope => :user)
end

Here's the reason:

Suppose you're including your ApplicationHelper in your controller. If you need a method in your ApplicationHelper that relies on devise_current_user, given the alias solution inside the controller, you're out of luck.

But with the explicit method definition above, you can move the definition to the helper and call it from other methods and you still get to include it in the controller.

This is useful, for example, when you're developing a user impersonation solution and you need to show two different users in the view, one for the real admin (devise_current_user) and the other, the impersonated user (current_user).

Indeed you are right. Please mention that the following should be included in the `ApplicationController `: `include ApplicationHelper`. Otherwise, `devise_current_user` becomes unknown. — Augustin Riedinger, Sep 21 '15 at 10:37

score 1 · Answer 3 · answered Feb 19 '17 at 19:07

Limbo-Peng's answer is great, but can be improved a little to make sure only admins can do this:

You'll need to also define a is_admin? method or is_admin attribute on the User class.

You may also want to use a different key than user_id, so it will never conflict with your regular parameters.

# to impersonate another user, e.g. for customer support
# only admins can do this..
#
alias_method :devise_current_user, :current_user
def current_user
  if ! params[:user_id].blank? \
     && devise_current_user && devise_current_user.is_admin? 
    User.find(params[:user_id])
  else
    devise_current_user
  end
end

score 0 · Answer 4 · answered Oct 28 '15 at 08:52

Assuming we can trust our session data (which relies on whether you put user input in there without proper authorization or not), this might work as a Concern:

module Concerns
  module ControllerWithImpersonation
    extend ActiveSupport::Concern

    included do
      helper_method :devise_current_user
    end

    def current_user
      if session[:impersonated_user_id].blank?
        devise_current_user
      else
        User.find(session[:impersonated_user_id])
      end
    end

    def devise_current_user
      @devise_current_user ||= warden.authenticate(:scope => :user)
    end

  end
end

I'm using this in a project for now.

A minor question (in the answer, sorry) ... should I be aware of any changes in Devise or Warden that make devise_current_user above outdated?

Where to override current_user helper method of devise gem

4 Answers4

Linked