5

I'm trying to implement a delayed-signup (aka delayed authentication aka gradual engagement) website flow using Devise + Rails.

By gradual engagement, I mean

"Don't make the user sign in until she absolutely has to, but let her play around and be remembered on the site"

I'm looking for a simple way to do this using devise. I feel like this is something many others have had to do, but I haven't found documentation on it.

The following approach sounds ok in my head, so I'm going to start with it:

  1. Create users that are only "rememberable"
  2. When certain pages are accessed, require that these users have more data on them, like a username and password, via something like "before_filter :authenticate_user!" in the appropriate controllers.

Does this approach make sense? Is there a better one? Do you have an implementation of a gradual engagement approach to signup/registration forms using Devise + Rails that you're willing to share?

Matt Briggs
  • 41,224
  • 16
  • 95
  • 126
jaime
  • 927
  • 8
  • 13

3 Answers3

2

I think the point of the article you gave us is to say:

  • only ask for sign up if necessary.

What does this mean?

Let's take an example. You're an e-commerce web site.

When does the customer has to sign up "at last"? During checkout. Never before. So you don't have to store, or remember anything about the user. Devise is never, never used here.

How do you manage the shopping cart of an unsigned in/up user? I'd say database, with session Id as primary key. Or You could store all the items ids in cookie, for later use.

In your code, if you have an action called checkout, just set in your controller a before_filter authenticate_user!, :only => [:checkout]

But maybe you have some constraints, like being able to keep your user's nickname without signing him up for example?

Pasta
  • 1,750
  • 2
  • 14
  • 25
  • be careful with storing to much information in cookies, sometimes it can cause security breach: http://guides.rubyonrails.org/security.html – Pasta Jan 19 '11 at 07:45
1

One alternate option is to do email-only signup, then send an email with a special link to finish registration later / bring them back to their account. There's an actively maintained tutorial on devise email-only signup at:

https://github.com/plataformatec/devise/wiki/How-To:-Email-only-sign-up

I've used this tutorial for a site I did a while back where we only asked for their email address to sign up, then later sent emails for them to complete registration / add a password.

Vivek Gani
  • 1,283
  • 14
  • 28
0

You can keep all unsigned user's data in cookies, and transfer them to database once the user logs in, if you need to.

Mirko
  • 5,207
  • 2
  • 37
  • 33
  • This is not a very detailed answer Mirko... what method should I use, then? I'm trying to do this through Devise's structure. (this has occurred to me and I'm still struggling with how to do it) – jaime Jan 18 '11 at 01:54
  • I think Pasta gave a thorough answer – Mirko Jan 18 '11 at 21:51
  • 1
    For anyone reading this and considering this approach, a word of caution. If you allow the client to supply details in a cookie (ie user id) which you then use server side to authenticate that user you need someway of ensuring they didn't just change the details. For example, userid 1 may be yourself as an admin. If you stash a userid in the cookie and then use that to decide what the user sees on the server then userid 2 can trivially change their cookie to userid 1 and become you. – Robin Jul 17 '11 at 09:42