Devise: Registering log in attempts

Question

I have a Rails 3.0 project using devise and I've been requested to register in DB every succesful login and every failed attempt.

From the devise documentation I think I'd have to extend FailureApp but the examples are just redirecting users and not using the model at all. In stackoverflow I've just found this question but it remained unanswered, which is not encouraging

Can anyone tell me if I'm correct in this approach or it can't be done this way, or if there is some easier alternative I'm missing?

(I know there is no code yet, I'm just looking for a small guidance before diving in)

Thanks.

score 6 · Answer 1 · answered Jun 27 '12 at 14:54

Spent a little bit of time looking into this myself and figured someone else might find this useful.

The create action in the devise controller calls warden.authenticate!, which attempts to authenticate the user with the supplied params. If authentication fails then authenticate! will call the devise failure app, which then runs the SessionsController#new action. Note, any filters you have for the create action will not run if authentication fails.

So the solution is to add a filter after the new action which checks the contents of env["warden.options"] and takes the appropriate action.

e.g.

def instrument_failed_login
  instrument "failed_login.staff" if failed_login?
end

def failed_login?
  (options = env["warden.options"]) && options[:action] == "unauthenticated"
end

Thanks @Matt; this was useful. Followed the instructions here to locally implement the logging of failed logins. Also, documented the steps in this answer : http://stackoverflow.com/a/12877182/429758 — Prakash Murthy, Oct 13 '12 at 21:32

score 4 · Answer 2 · edited Jun 15 '15 at 14:10

4

An alternative and more maintainable way of adding logging around Devise authentication is to use the Warden Callbacks in an initializer. This is preferable because it uses the Warden API's designed for this and doesn't involve copy/pasting controller code.

Warden::Manager.before_failure do |env, opts|
    logger.error("opts[:scope] authentication failure: #{opts[:message]}")
end

You can do the same with Warden::Manager#after_authentication and Warden::Manager#before_logout.

edited Jun 15 '15 at 14:10

Sebastien

6,640
14
57
105

answered Nov 24 '14 at 16:46

Daniel Westendorf

3,375
18
23

Is it possible to access the User via this callback? – atw Jun 25 '21 at 15:05

score 3 · Accepted Answer · edited Sep 25 '22 at 06:25

3

Modifying Devise::SessionsController to do your dirty work will do the trick.

Simply copy that file into your app/controllers/devise/sessions_controller.rb

Once you've done that, just add some code to where the user successfully logs in and where he fails to log in that will do what you want.

You'll probably want to create a new model for tracking login records.

edited Sep 25 '22 at 06:25

Jai Chauhan

4,035
3
36
62

answered Nov 17 '11 at 17:55

fivetwentysix

7,379
9
40
58

Thanks, finding how to do intercept a failed attemp was tricky but it seems to be working. – madth3 Nov 18 '11 at 02:25

Devise: Registering log in attempts

3 Answers3

Linked