diff options
Diffstat (limited to 'config/initializers/devise.rb')
-rw-r--r-- | config/initializers/devise.rb | 278 |
1 files changed, 278 insertions, 0 deletions
diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb new file mode 100644 index 0000000..f85c0a6 --- /dev/null +++ b/config/initializers/devise.rb | |||
@@ -0,0 +1,278 @@ | |||
1 | # Use this hook to configure devise mailer, warden hooks and so forth. | ||
2 | # Many of these configuration options can be set straight in your model. | ||
3 | Devise.setup do |config| | ||
4 | # The secret key used by Devise. Devise uses this key to generate | ||
5 | # random tokens. Changing this key will render invalid all existing | ||
6 | # confirmation, reset password and unlock tokens in the database. | ||
7 | # Devise will use the `secret_key_base` as its `secret_key` | ||
8 | # by default. You can change it below and use your own secret key. | ||
9 | # config.secret_key = 'f85d289a63b03808f899604ae6f3b1ba93430a8a7e9a5c0ee817471e4d4e201f000e8d42386392d4c24add7b4e2f0e011ea491c1febb57b37301e63b67f0ed60' | ||
10 | |||
11 | # ==> Mailer Configuration | ||
12 | # Configure the e-mail address which will be shown in Devise::Mailer, | ||
13 | # note that it will be overwritten if you use your own mailer class | ||
14 | # with default "from" parameter. | ||
15 | config.mailer_sender = 'no-reply@feffernoo.se' | ||
16 | |||
17 | # Configure the class responsible to send e-mails. | ||
18 | # config.mailer = 'Devise::Mailer' | ||
19 | |||
20 | # Configure the parent class responsible to send e-mails. | ||
21 | # config.parent_mailer = 'ActionMailer::Base' | ||
22 | |||
23 | # ==> ORM configuration | ||
24 | # Load and configure the ORM. Supports :active_record (default) and | ||
25 | # :mongoid (bson_ext recommended) by default. Other ORMs may be | ||
26 | # available as additional gems. | ||
27 | require 'devise/orm/active_record' | ||
28 | |||
29 | # ==> Configuration for any authentication mechanism | ||
30 | # Configure which keys are used when authenticating a user. The default is | ||
31 | # just :email. You can configure it to use [:username, :subdomain], so for | ||
32 | # authenticating a user, both parameters are required. Remember that those | ||
33 | # parameters are used only when authenticating and not when retrieving from | ||
34 | # session. If you need permissions, you should implement that in a before filter. | ||
35 | # You can also supply a hash where the value is a boolean determining whether | ||
36 | # or not authentication should be aborted when the value is not present. | ||
37 | # config.authentication_keys = [:email] | ||
38 | config.authentication_keys = [:login] | ||
39 | |||
40 | # Configure parameters from the request object used for authentication. Each entry | ||
41 | # given should be a request method and it will automatically be passed to the | ||
42 | # find_for_authentication method and considered in your model lookup. For instance, | ||
43 | # if you set :request_keys to [:subdomain], :subdomain will be used on authentication. | ||
44 | # The same considerations mentioned for authentication_keys also apply to request_keys. | ||
45 | # config.request_keys = [] | ||
46 | |||
47 | # Configure which authentication keys should be case-insensitive. | ||
48 | # These keys will be downcased upon creating or modifying a user and when used | ||
49 | # to authenticate or find a user. Default is :email. | ||
50 | config.case_insensitive_keys = [] | ||
51 | |||
52 | # Configure which authentication keys should have whitespace stripped. | ||
53 | # These keys will have whitespace before and after removed upon creating or | ||
54 | # modifying a user and when used to authenticate or find a user. Default is :email. | ||
55 | config.strip_whitespace_keys = [:login] | ||
56 | |||
57 | # Tell if authentication through request.params is enabled. True by default. | ||
58 | # It can be set to an array that will enable params authentication only for the | ||
59 | # given strategies, for example, `config.params_authenticatable = [:database]` will | ||
60 | # enable it only for database (email + password) authentication. | ||
61 | # config.params_authenticatable = true | ||
62 | |||
63 | # Tell if authentication through HTTP Auth is enabled. False by default. | ||
64 | # It can be set to an array that will enable http authentication only for the | ||
65 | # given strategies, for example, `config.http_authenticatable = [:database]` will | ||
66 | # enable it only for database authentication. The supported strategies are: | ||
67 | # :database = Support basic authentication with authentication key + password | ||
68 | # config.http_authenticatable = false | ||
69 | |||
70 | # If 401 status code should be returned for AJAX requests. True by default. | ||
71 | # config.http_authenticatable_on_xhr = true | ||
72 | |||
73 | # The realm used in Http Basic Authentication. 'Application' by default. | ||
74 | # config.http_authentication_realm = 'Application' | ||
75 | |||
76 | # It will change confirmation, password recovery and other workflows | ||
77 | # to behave the same regardless if the e-mail provided was right or wrong. | ||
78 | # Does not affect registerable. | ||
79 | # config.paranoid = true | ||
80 | |||
81 | # By default Devise will store the user in session. You can skip storage for | ||
82 | # particular strategies by setting this option. | ||
83 | # Notice that if you are skipping storage for all authentication paths, you | ||
84 | # may want to disable generating routes to Devise's sessions controller by | ||
85 | # passing skip: :sessions to `devise_for` in your config/routes.rb | ||
86 | config.skip_session_storage = [:http_auth] | ||
87 | |||
88 | # By default, Devise cleans up the CSRF token on authentication to | ||
89 | # avoid CSRF token fixation attacks. This means that, when using AJAX | ||
90 | # requests for sign in and sign up, you need to get a new CSRF token | ||
91 | # from the server. You can disable this option at your own risk. | ||
92 | # config.clean_up_csrf_token_on_authentication = true | ||
93 | |||
94 | # When false, Devise will not attempt to reload routes on eager load. | ||
95 | # This can reduce the time taken to boot the app but if your application | ||
96 | # requires the Devise mappings to be loaded during boot time the application | ||
97 | # won't boot properly. | ||
98 | # config.reload_routes = true | ||
99 | |||
100 | # ==> Configuration for :database_authenticatable | ||
101 | # For bcrypt, this is the cost for hashing the password and defaults to 11. If | ||
102 | # using other algorithms, it sets how many times you want the password to be hashed. | ||
103 | # | ||
104 | # Limiting the stretches to just one in testing will increase the performance of | ||
105 | # your test suite dramatically. However, it is STRONGLY RECOMMENDED to not use | ||
106 | # a value less than 10 in other environments. Note that, for bcrypt (the default | ||
107 | # algorithm), the cost increases exponentially with the number of stretches (e.g. | ||
108 | # a value of 20 is already extremely slow: approx. 60 seconds for 1 calculation). | ||
109 | config.stretches = Rails.env.test? ? 1 : 11 | ||
110 | |||
111 | # Set up a pepper to generate the hashed password. | ||
112 | # config.pepper = '371cc1e0f4d476a1969326be1ae6e43e8959b187b04be1b39225325a9429541174c0de9ddb3cf270dbf03d7df0711c744b82ca8d9fd27f69a09bf8162d262f80' | ||
113 | |||
114 | # Send a notification to the original email when the user's email is changed. | ||
115 | # config.send_email_changed_notification = false | ||
116 | |||
117 | # Send a notification email when the user's password is changed. | ||
118 | # config.send_password_change_notification = false | ||
119 | |||
120 | # ==> Configuration for :confirmable | ||
121 | # A period that the user is allowed to access the website even without | ||
122 | # confirming their account. For instance, if set to 2.days, the user will be | ||
123 | # able to access the website for two days without confirming their account, | ||
124 | # access will be blocked just in the third day. Default is 0.days, meaning | ||
125 | # the user cannot access the website without confirming their account. | ||
126 | # config.allow_unconfirmed_access_for = 2.days | ||
127 | |||
128 | # A period that the user is allowed to confirm their account before their | ||
129 | # token becomes invalid. For example, if set to 3.days, the user can confirm | ||
130 | # their account within 3 days after the mail was sent, but on the fourth day | ||
131 | # their account can't be confirmed with the token any more. | ||
132 | # Default is nil, meaning there is no restriction on how long a user can take | ||
133 | # before confirming their account. | ||
134 | # config.confirm_within = 3.days | ||
135 | |||
136 | # If true, requires any email changes to be confirmed (exactly the same way as | ||
137 | # initial account confirmation) to be applied. Requires additional unconfirmed_email | ||
138 | # db field (see migrations). Until confirmed, new email is stored in | ||
139 | # unconfirmed_email column, and copied to email column on successful confirmation. | ||
140 | config.reconfirmable = true | ||
141 | |||
142 | # Defines which key will be used when confirming an account | ||
143 | # config.confirmation_keys = [:email] | ||
144 | |||
145 | # ==> Configuration for :rememberable | ||
146 | # The time the user will be remembered without asking for credentials again. | ||
147 | # config.remember_for = 2.weeks | ||
148 | |||
149 | # Invalidates all the remember me tokens when the user signs out. | ||
150 | config.expire_all_remember_me_on_sign_out = true | ||
151 | |||
152 | # If true, extends the user's remember period when remembered via cookie. | ||
153 | # config.extend_remember_period = false | ||
154 | |||
155 | # Options to be passed to the created cookie. For instance, you can set | ||
156 | # secure: true in order to force SSL only cookies. | ||
157 | # config.rememberable_options = {} | ||
158 | |||
159 | # ==> Configuration for :validatable | ||
160 | # Range for password length. | ||
161 | config.password_length = 6..128 | ||
162 | |||
163 | # Email regex used to validate email formats. It simply asserts that | ||
164 | # one (and only one) @ exists in the given string. This is mainly | ||
165 | # to give user feedback and not to assert the e-mail validity. | ||
166 | config.email_regexp = /\A[^@\s]+@[^@\s]+\z/ | ||
167 | |||
168 | # ==> Configuration for :timeoutable | ||
169 | # The time you want to timeout the user session without activity. After this | ||
170 | # time the user will be asked for credentials again. Default is 30 minutes. | ||
171 | # config.timeout_in = 30.minutes | ||
172 | |||
173 | # ==> Configuration for :lockable | ||
174 | # Defines which strategy will be used to lock an account. | ||
175 | # :failed_attempts = Locks an account after a number of failed attempts to sign in. | ||
176 | # :none = No lock strategy. You should handle locking by yourself. | ||
177 | # config.lock_strategy = :failed_attempts | ||
178 | |||
179 | # Defines which key will be used when locking and unlocking an account | ||
180 | # config.unlock_keys = [:email] | ||
181 | |||
182 | # Defines which strategy will be used to unlock an account. | ||
183 | # :email = Sends an unlock link to the user email | ||
184 | # :time = Re-enables login after a certain amount of time (see :unlock_in below) | ||
185 | # :both = Enables both strategies | ||
186 | # :none = No unlock strategy. You should handle unlocking by yourself. | ||
187 | # config.unlock_strategy = :both | ||
188 | |||
189 | # Number of authentication tries before locking an account if lock_strategy | ||
190 | # is failed attempts. | ||
191 | # config.maximum_attempts = 20 | ||
192 | |||
193 | # Time interval to unlock the account if :time is enabled as unlock_strategy. | ||
194 | # config.unlock_in = 1.hour | ||
195 | |||
196 | # Warn on the last attempt before the account is locked. | ||
197 | # config.last_attempt_warning = true | ||
198 | |||
199 | # ==> Configuration for :recoverable | ||
200 | # | ||
201 | # Defines which key will be used when recovering the password for an account | ||
202 | # config.reset_password_keys = [:email] | ||
203 | |||
204 | # Time interval you can reset your password with a reset password key. | ||
205 | # Don't put a too small interval or your users won't have the time to | ||
206 | # change their passwords. | ||
207 | config.reset_password_within = 6.hours | ||
208 | |||
209 | # When set to false, does not sign a user in automatically after their password is | ||
210 | # reset. Defaults to true, so a user is signed in automatically after a reset. | ||
211 | # config.sign_in_after_reset_password = true | ||
212 | |||
213 | # ==> Configuration for :encryptable | ||
214 | # Allow you to use another hashing or encryption algorithm besides bcrypt (default). | ||
215 | # You can use :sha1, :sha512 or algorithms from others authentication tools as | ||
216 | # :clearance_sha1, :authlogic_sha512 (then you should set stretches above to 20 | ||
217 | # for default behavior) and :restful_authentication_sha1 (then you should set | ||
218 | # stretches to 10, and copy REST_AUTH_SITE_KEY to pepper). | ||
219 | # | ||
220 | # Require the `devise-encryptable` gem when using anything other than bcrypt | ||
221 | # config.encryptor = :sha512 | ||
222 | |||
223 | # ==> Scopes configuration | ||
224 | # Turn scoped views on. Before rendering "sessions/new", it will first check for | ||
225 | # "users/sessions/new". It's turned off by default because it's slower if you | ||
226 | # are using only default views. | ||
227 | # config.scoped_views = false | ||
228 | |||
229 | # Configure the default scope given to Warden. By default it's the first | ||
230 | # devise role declared in your routes (usually :user). | ||
231 | # config.default_scope = :user | ||
232 | |||
233 | # Set this configuration to false if you want /users/sign_out to sign out | ||
234 | # only the current scope. By default, Devise signs out all scopes. | ||
235 | # config.sign_out_all_scopes = true | ||
236 | |||
237 | # ==> Navigation configuration | ||
238 | # Lists the formats that should be treated as navigational. Formats like | ||
239 | # :html, should redirect to the sign in page when the user does not have | ||
240 | # access, but formats like :xml or :json, should return 401. | ||
241 | # | ||
242 | # If you have any extra navigational formats, like :iphone or :mobile, you | ||
243 | # should add them to the navigational formats lists. | ||
244 | # | ||
245 | # The "*/*" below is required to match Internet Explorer requests. | ||
246 | # config.navigational_formats = ['*/*', :html] | ||
247 | |||
248 | # The default HTTP method used to sign out a resource. Default is :delete. | ||
249 | config.sign_out_via = :delete | ||
250 | |||
251 | # ==> OmniAuth | ||
252 | # Add a new OmniAuth provider. Check the wiki for more information on setting | ||
253 | # up on your models and hooks. | ||
254 | # config.omniauth :github, 'APP_ID', 'APP_SECRET', scope: 'user,public_repo' | ||
255 | |||
256 | # ==> Warden configuration | ||
257 | # If you want to use other strategies, that are not supported by Devise, or | ||
258 | # change the failure app, you can configure them inside the config.warden block. | ||
259 | # | ||
260 | # config.warden do |manager| | ||
261 | # manager.intercept_401 = false | ||
262 | # manager.default_strategies(scope: :user).unshift :some_external_strategy | ||
263 | # end | ||
264 | |||
265 | # ==> Mountable engine configurations | ||
266 | # When using Devise inside an engine, let's call it `MyEngine`, and this engine | ||
267 | # is mountable, there are some extra configurations to be taken into account. | ||
268 | # The following options are available, assuming the engine is mounted as: | ||
269 | # | ||
270 | # mount MyEngine, at: '/my_engine' | ||
271 | # | ||
272 | # The router that invoked `devise_for`, in the example above, would be: | ||
273 | # config.router_name = :my_engine | ||
274 | # | ||
275 | # When using OmniAuth, Devise cannot automatically set OmniAuth path, | ||
276 | # so you need to do it manually. For the users scope, it would be: | ||
277 | # config.omniauth_path_prefix = '/my_engine/users/auth' | ||
278 | end | ||