How To: Allow users to edit their account without providing a password

Jason Winn edited this page Nov 21, 2018 · 71 revisions

By default, Devise allows users to change their password using the :registerable module. But sometimes, developers want to create other actions that allow the user to change their information without requiring a password. The best option in this case is to create your own controller, that belongs to your application, and provide an edit and update actions, as you would do for any other resource in your application.

Keep in mind though to be restrictive in the parameters you allow to be changed. In particular, you likely want to permit just user data fields and avoid e-mail, password and such information to be changed:

params(:user).permit(:first_name, :last_name, :address)

An alternative solution would be to simply override the update_resource method in your registrations controller as follows:

# app/controllers/registrations_controller.rb
class RegistrationsController < Devise::RegistrationsController

  protected

  def update_resource(resource, params)
    resource.update_without_password(params)
  end
end

''Attention'': This way of using this method does not allow the user to change his or her password.

When using this solution you will need to tell devise to use your controller in routes.rb:

devise_for :users, controllers: { registrations: 'registrations' }

Finally, if you have generated views using devise, remove the corresponding form input for 'current_password' in app/views/devise/registrations/edit.html.erb.

Clone this wiki locally
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.
Press h to open a hovercard with more details.