Does anyone used `attr_encrypted` with Devise ?

[jaleszek]

I'm trying to have symmetrical encryption on the email attribute which used to authentication by Devise. Does anyone worked with this ?

I'm using following modules:
devise :database_authenticatable, :registerable, :confirmable, :recoverable, :rememberable, ,trackable

and actually have problem with not existing email column:

PG::UndefinedColumn - ERROR:  column users.email does not exist
LINE 1: ...M "users"  WHERE "users"."deleted_at" IS NULL AND "users"."e...
                                                             ^
:
  activerecord (4.0.4) lib/active_record/connection_adapters/postgresql_adapter.rb:791:in `exec_no_cache'
  activerecord (4.0.4) lib/active_record/connection_adapters/postgresql/database_statements.rb:138:in `block in exec_query'
  activerecord (4.0.4) lib/active_record/connection_adapters/abstract_adapter.rb:442:in `block in log'
  activesupport (4.0.4) lib/active_support/notifications/instrumenter.rb:20:in `instrument'
  activerecord (4.0.4) lib/active_record/connection_adapters/abstract_adapter.rb:437:in `log'
  activerecord (4.0.4) lib/active_record/connection_adapters/postgresql/database_statements.rb:137:in `exec_query'
  activerecord (4.0.4) lib/active_record/connection_adapters/postgresql_adapter.rb:908:in `select'
  activerecord (4.0.4) lib/active_record/connection_adapters/abstract/database_statements.rb:32:in `select_all'
  activerecord (4.0.4) lib/active_record/connection_adapters/abstract/query_cache.rb:61:in `block in select_all'
  activerecord (4.0.4) lib/active_record/connection_adapters/abstract/query_cache.rb:76:in `cache_sql'
  activerecord (4.0.4) lib/active_record/connection_adapters/abstract/query_cache.rb:61:in `select_all'
  activerecord (4.0.4) lib/active_record/querying.rb:36:in `find_by_sql'
  activerecord (4.0.4) lib/active_record/relation.rb:585:in `exec_queries'
  activerecord (4.0.4) lib/active_record/relation.rb:471:in `load'
  activerecord (4.0.4) lib/active_record/relation.rb:220:in `to_a'
  activerecord (4.0.4) lib/active_record/relation.rb:598:in `exec_queries'
  activerecord (4.0.4) lib/active_record/relation.rb:471:in `load'
  activerecord (4.0.4) lib/active_record/relation.rb:220:in `to_a'
  activerecord (4.0.4) lib/active_record/relation/finder_methods.rb:326:in `find_first'
  activerecord (4.0.4) lib/active_record/relation/finder_methods.rb:91:in `first'
  activerecord-deprecated_finders (1.0.3) lib/active_record/deprecated_finders/relation.rb:129:in `first'
  orm_adapter (0.5.0) lib/orm_adapter/adapters/active_record.rb:22:in `find_first'
  devise (3.2.4) lib/devise/models/authenticatable.rb:246:in `find_first_by_auth_conditions'
  devise (3.2.4) lib/devise/models/authenticatable.rb:242:in `find_for_authentication'
  devise (3.2.4) lib/devise/models/database_authenticatable.rb:155:in `find_for_database_authentication'
  devise (3.2.4) lib/devise/strategies/database_authenticatable.rb:8:in `authenticate!'
  warden (1.2.3) lib/warden/strategies/base.rb:53:in `_run!'
  warden (1.2.3) lib/warden/proxy.rb:354:in `block in _run_strategies_for'
  warden (1.2.3) lib/warden/proxy.rb:349:in `_run_strategies_for'
  warden (1.2.3) lib/warden/proxy.rb:319:in `_perform_authentication'
  warden (1.2.3) lib/warden/proxy.rb:127:in `authenticate!'
  devise (3.2.4) app/controllers/devise/sessions_controller.rb:15:in `create'
  actionpack (4.0.4) lib/action_controller/metal/implicit_render.rb:4:in `send_action'
  actionpack (4.0.4) lib/abstract_controller/base.rb:189:in `process_action'
  actionpack (4.0.4) lib/action_controller/metal/rendering.rb:10:in `process_action'
  actionpack (4.0.4) lib/abstract_controller/callbacks.rb:18:in `block in process_action'
  activesupport (4.0.4) lib/active_support/callbacks.rb:443:in `_run__4377103782540181189__process_action__callbacks'
  activesupport (4.0.4) lib/active_support/callbacks.rb:80:in `run_callbacks'
  actionpack (4.0.4) lib/abstract_controller/callbacks.rb:17:in `process_action'
  actionpack (4.0.4) lib/action_controller/metal/rescue.rb:29:in `process_action'
  actionpack (4.0.4) lib/action_controller/metal/instrumentation.rb:31:in `block in process_action'
  activesupport (4.0.4) lib/active_support/notifications.rb:159:in `block in instrument'
  activesupport (4.0.4) lib/active_support/notifications/instrumenter.rb:20:in `instrument'
  activesupport (4.0.4) lib/active_support/notifications.rb:159:in `instrument'
  actionpack (4.0.4) lib/action_controller/metal/instrumentation.rb:30:in `process_action'
  actionpack (4.0.4) lib/action_controller/metal/params_wrapper.rb:250:in `process_action'
  activerecord (4.0.4) lib/active_record/railties/controller_runtime.rb:18:in `process_action'
  actionpack (4.0.4) lib/abstract_controller/base.rb:136:in `process'
  actionpack (4.0.4) lib/abstract_controller/rendering.rb:44:in `process'
  actionpack (4.0.4) lib/action_controller/metal.rb:195:in `dispatch'
  actionpack (4.0.4) lib/action_controller/metal/rack_delegation.rb:13:in `dispatch'
  actionpack (4.0.4) lib/action_controller/metal.rb:231:in `block in action'
  actionpack (4.0.4) lib/action_dispatch/routing/route_set.rb:80:in `dispatch'
  actionpack (4.0.4) lib/action_dispatch/routing/route_set.rb:48:in `call'
  actionpack (4.0.4) lib/action_dispatch/routing/mapper.rb:44:in `call'
  actionpack (4.0.4) lib/action_dispatch/journey/router.rb:71:in `block in call'
  actionpack (4.0.4) lib/action_dispatch/journey/router.rb:59:in `call'
  actionpack (4.0.4) lib/action_dispatch/routing/route_set.rb:674:in `call'
  newrelic_rpm (3.7.3.204) lib/new_relic/rack/error_collector.rb:55:in `call'
  newrelic_rpm (3.7.3.204) lib/new_relic/rack/agent_hooks.rb:32:in `call'
  newrelic_rpm (3.7.3.204) lib/new_relic/rack/browser_monitoring.rb:27:in `call'
  newrelic_rpm (3.7.3.204) lib/new_relic/rack/developer_mode.rb:45:in `call'
  warden (1.2.3) lib/warden/manager.rb:35:in `block in call'
  warden (1.2.3) lib/warden/manager.rb:34:in `call'
  rack (1.5.2) lib/rack/etag.rb:23:in `call'
  rack (1.5.2) lib/rack/conditionalget.rb:35:in `call'
  rack (1.5.2) lib/rack/head.rb:11:in `call'
  actionpack (4.0.4) lib/action_dispatch/middleware/params_parser.rb:27:in `call'
  actionpack (4.0.4) lib/action_dispatch/middleware/flash.rb:241:in `call'
  rack (1.5.2) lib/rack/session/abstract/id.rb:225:in `context'
  rack (1.5.2) lib/rack/session/abstract/id.rb:220:in `call'
  actionpack (4.0.4) lib/action_dispatch/middleware/cookies.rb:486:in `call'
  activerecord (4.0.4) lib/active_record/query_cache.rb:36:in `call'
  activerecord (4.0.4) lib/active_record/connection_adapters/abstract/connection_pool.rb:626:in `call'
  activerecord (4.0.4) lib/active_record/migration.rb:373:in `call'
  actionpack (4.0.4) lib/action_dispatch/middleware/callbacks.rb:29:in `block in call'
  activesupport (4.0.4) lib/active_support/callbacks.rb:373:in `_run__1071435100797958031__call__callbacks'
  activesupport (4.0.4) lib/active_support/callbacks.rb:80:in `run_callbacks'
  actionpack (4.0.4) lib/action_dispatch/middleware/callbacks.rb:27:in `call'
  actionpack (4.0.4) lib/action_dispatch/middleware/reloader.rb:64:in `call'
  actionpack (4.0.4) lib/action_dispatch/middleware/remote_ip.rb:76:in `call'
  better_errors (1.1.0) lib/better_errors/middleware.rb:84:in `protected_app_call'
  better_errors (1.1.0) lib/better_errors/middleware.rb:79:in `better_errors_call'
  better_errors (1.1.0) lib/better_errors/middleware.rb:56:in `call'
  actionpack (4.0.4) lib/action_dispatch/middleware/debug_exceptions.rb:17:in `call'
  actionpack (4.0.4) lib/action_dispatch/middleware/show_exceptions.rb:30:in `call'
  railties (4.0.4) lib/rails/rack/logger.rb:38:in `call_app'
  railties (4.0.4) lib/rails/rack/logger.rb:20:in `block in call'
  activesupport (4.0.4) lib/active_support/tagged_logging.rb:68:in `block in tagged'
  activesupport (4.0.4) lib/active_support/tagged_logging.rb:26:in `tagged'
  activesupport (4.0.4) lib/active_support/tagged_logging.rb:68:in `tagged'
  railties (4.0.4) lib/rails/rack/logger.rb:20:in `call'
  quiet_assets (1.0.2) lib/quiet_assets.rb:18:in `call_with_quiet_assets'
  actionpack (4.0.4) lib/action_dispatch/middleware/request_id.rb:21:in `call'
  rack (1.5.2) lib/rack/methodoverride.rb:21:in `call'
  rack (1.5.2) lib/rack/runtime.rb:17:in `call'
  activesupport (4.0.4) lib/active_support/cache/strategy/local_cache.rb:83:in `call'
  rack (1.5.2) lib/rack/lock.rb:17:in `call'
  actionpack (4.0.4) lib/action_dispatch/middleware/static.rb:64:in `call'
  rack (1.5.2) lib/rack/sendfile.rb:112:in `call'
  railties (4.0.4) lib/rails/engine.rb:511:in `call'
  railties (4.0.4) lib/rails/application.rb:97:in `call'
  rack (1.5.2) lib/rack/lock.rb:17:in `call'
  rack (1.5.2) lib/rack/content_length.rb:14:in `call'
  rack (1.5.2) lib/rack/handler/webrick.rb:60:in `service'
  /home/leszek/.rvm/rubies/ruby-2.0.0-p481/lib/ruby/2.0.0/webrick/httpserver.rb:138:in `service'
  /home/leszek/.rvm/rubies/ruby-2.0.0-p481/lib/ruby/2.0.0/webrick/httpserver.rb:94:in `run'
  /home/leszek/.rvm/rubies/ruby-2.0.0-p481/lib/ruby/2.0.0/webrick/server.rb:295:in `block in start_thread'

[Tenari]

I too am having this issue

[saghaulor]

@jaleszek @Tenari Can you please include information regarding how you are using attr_encrypted in your model?

[Tenari]

I am encrypting the email, which messes up the devise lookups by email, because devise doesn't actually use the method User.find_by_email(), which is the method attr_encrypted replaces with it's own magic. I've got a partial work around, though, which is to just overwrite the pertinent devise methods within my own app/models/user.rb file so that it works. I haven't finished this up yet, but I've overwritten this:

def email_changed?
  encrypted_email_changed?
end

def self.find_for_authentication(tainted_conditions)
  User.find_by_email(tainted_conditions[:email])
end

[Tenari]

Also, encrypting the email attribute breaks the :validatable option on the devise call. Had to replace the validations with hand-written ones.

[juanjzv]

@Tenari Please share your solution, I'm in the same trouble here. What other devise methods did you have to overwrite? What is "tainted_conditions" in your "find for authentication" method?

[Tenari]

It's just the param that devise was passing into it's own original version of find_for_authentication.
Also, I was/am using an older version of devise: devise (3.0.3) so the methods I had to overwrite are not necessarily the same ones you'll need to overwrite. What I suggest is this:

1. make a list of all devise-based actions that can occur on the app
2. going through them all:

a. encounter a stacktrace, and find the devise method in the trace
b. open the devise source code to said method and grok it's meaning.
c. write your own version, compatible with attr_encrypted
d. re-try action to make sure it works now.
3. repeat until everything is fixed or you destroy your computer due to frustration.

[Tenari]

Also had to overwrite:

• self.find_first_by_auth_conditions(tainted_conditions, opts={})
• password_required?
• email_was
  • just made it look like this: User.decrypt_email(encrypted_email_was)
• apply_to_attribute_or_variable(attr, method)

[juanjzv]

Thanks!

[saghaulor]

I'm not very familiar with Devise, so I can't offer much help at the moment. Is it possible to provide alternate fields to use with authentication? Namely, can you use 'login' instead of 'email' to authenticate users? That way you can still encrypt the email and not have issues with Devise. Perhaps I'm missing the point?

[juanjzv]

Yeah, devise lets you change the authentication field, like using username instead of :email

[juanjzv]

I've just tried to change the authentication key to username instead of email, but I got the same problem.

[richhollis]

This issue is ranking pretty highly on Google for 'devise and attr_encrypted'

I found some of the info in this thread useful. I wanted to encrypt the email address and use username as the authentication_key (in the clear).

In case it helps others, I've created a gist with the changes I made to get it going with Rails 4 & Devise 3.5.6: https://gist.github.com/richhollis/47e614d139e99d88615d

[balakirevs]

Has anyone achived to make it work ?