devise

devise copied to clipboard

Use `:unprocessable_content` in generated Devise config for Rack 3.1+

1

### Background In Rack v3.1.0, the symbol for HTTP status code 422 was changed from `:unprocessable_entity` to `:unprocessable_content`. As a result, when using rack 3.2 with the following configuration in...

taketo1113

Tell the recipient software when a password link expires.

3

https://datatracker.ietf.org/doc/draft-ietf-mailmaint-expires/ That draft documents the (rare) existing usage of the Expires field, specifies a tighter syntax, and clarifies that "expires" doesn't mean having to delete anything. "Automatically moving the message...

arnt

`Confirmable` "change email" vulnerability - race condition permits user to confirm email address they have no access to

6

I have attempted to report this via email (to `[email protected]`) as requested in the README, but after 90 days of no response after several follow-ups, I feel it's better to...

grantcox

Advise for making Devise work with Outlook Safelinks

1

Hey team, looking for help for what we can do with Devise to handle Outlook Safelinks. From what i understand, Safelinks takes any href out of an email and transforms...

alexanderholder

PR proposal: would a magic link / passwordless auth strategy be considered for merge?

1

[I wrote this Devise extension](https://github.com/abevoelker/devise-passwordless) that adds a `:magic_link_authenticatable` auth strategy that enables passwordless login via sending "magic link" emails. I was wondering if this is a feature Devise would...

abevoelker

Fix email enumeration vulnerabilities in password reset and registration flows

8

## Summary - Fixes email enumeration vulnerabilities in both password reset and registration flows - Makes secure behavior the default for password reset (breaking change) - Adds paranoid mode support...

natevick

## Description This PR adds support for computed `To` header in Devise mailers, allowing users to customize the recipient field using `default :to` declarations, similar to how `from` and `reply_to`...

boypie510

Rack updated its status codes to be in sync with IANA HTTP Status Code Registry : https://github.com/rack/rack/pull/2137 The 422 status code is now `Unprocessable Content` instead of `Unprocessable Entity`. While...

Lersoo

This PR fixes the commented example default value for `config.parent_controller` in the Devise initializer template (`config/initializers/devise.rb`). The previous example set `config.parent_controller` to `DeviseController`, which is incorrect. The actual default parent...

penguin-10

Fix race condition vulnerability, by ensuring the `unconfirmed_email` is always saved

1

Fixes https://github.com/heartcombo/devise/issues/5783

grantcox