Rails 3 Authentication: Authlogic vs Devise

Question

I have always used Authlogic in Rails 2.3 but now that I am using Rails 3 I think I might try out a new authentication solution.

How does Devise compare with Authlogic? What are their differences?

Answer 1

I've used them both, but not extensively. In my last project, I gave Devise a shot. I ended up using Rails-Warden instead.

Devise is a full authentication framework built on top of Warden. To customize its looks, you use generators, then edit the resulting views. Its routes, and view logic are hard coded. For example, successful login will always take you to /session/new? This was a dealbreaker or me, I wanted my users to end up on "welcome/index". Devise is not as well documented, or intuitive as authlogic.

Warden is a middleware framework Devise is based upon. It has plugins for many web authentication schemes (fb, openid, oauth), and it is easy to build a plugin for your own authentication back end. It comes with no UI, and docs are not as good as authlogic.

I ended up using rails-warden because I needed to plugin multiple custom authentication schemes.

Also, see OmniAuth answer below, that's what I am using in 2012.

Answer 2

for devise, if you want to send successful login to "welcome/index" you add to routes.rb

namespace :user do
    root :to => "welcome#index"
end

as documented https://github.com/plataformatec/devise/wiki/How-To:-Redirect-to-a-specific-page-on-successful-sign-in

personally, i like devise. it think it's great and i guess you can call it "opinionated" but those opinions can be easily overwritten.

Answer 3

I found Devise too opinionated for me. If you just want to accept the way it does things out of the box it is good and easy to get going. I had some specific requirements and found myself writing things to get round Devise so ended up ripping it out and updating Authlogic to Rails3 instead.