mardi 18 septembre 2018

User clicks on forgot password links ends up logging into application if some other user is logged in on same browser

I am using devise for authentication and using devise's default forgot password flow. When user clicks on forgot password link http://localhost:3000/users/password/edit?reset_password_token=F1XrgcSTYs5nssRZrLqf then the user logs into application if some other user is already logged into the application on same browser. I understand It happens because devise checks @current_user in session and @current_user is the one who is logged in application on that browser.

I can I change the behaviour, User who clicks should not login and should be redirected to reset password page.

Aucun commentaire:

Enregistrer un commentaire