How To: Allow users to edit their password

By default, Devise allows users to change their password using the registerable module. But sometimes, developers want to provide their custom actions that change the password. In such cases, the best option is for you to create manually a controller:

class SettingsController < ApplicationController
  def edit
    @user = current_user
  end

  def update_password
    @user = User.find(current_user.id)
    if @user.update_attributes(params[:user])
      # Sign in the user by passing validation in case his password changed
      sign_in @user, :bypass => true
      redirect_to root_path
    else
      render "edit"
    end
  end
end

And then proceed to implement the views. Remember, Devise models are like any model in your application. If you want to provide custom behavior, just implement new actions and new controllers. Don't try to bend Devise.

TODO: How to use a "confirm_password" field to force user to enter old password before updating with the new one