1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
# frozen_string_literal: true
require 'devise/strategies/authenticatable'
module Devise
module Strategies
# Remember the user through the remember token. This strategy is responsible
# to verify whether there is a cookie with the remember token, and to
# recreate the user from this cookie if it exists. Must be called *before*
# authenticatable.
class Rememberable < Authenticatable
# A valid strategy for rememberable needs a remember token in the cookies.
def valid?
@remember_cookie = nil
remember_cookie.present?
end
# To authenticate a user we deserialize the cookie and attempt finding
# the record in the database. If the attempt fails, we pass to another
# strategy handle the authentication.
def authenticate!
resource = mapping.to.serialize_from_cookie(*remember_cookie)
unless resource
cookies.delete(remember_key)
return pass
end
if validate(resource)
remember_me(resource) if extend_remember_me?(resource)
resource.after_remembered
success!(resource)
end
end
# No need to clean up the CSRF when using rememberable.
# In fact, cleaning it up here would be a bug because
# rememberable is triggered on GET requests which means
# we would render a page on first access with all csrf
# tokens expired.
def clean_up_csrf?
false
end
private
def extend_remember_me?(resource)
resource.respond_to?(:extend_remember_period) && resource.extend_remember_period
end
def remember_me?
true
end
def remember_key
mapping.to.rememberable_options.fetch(:key, "remember_#{scope}_token")
end
def remember_cookie
@remember_cookie ||= cookies.signed[remember_key]
end
end
end
end
Warden::Strategies.add(:rememberable, Devise::Strategies::Rememberable)
|
