Devise Security

Build Status Coverage Status Maintainability

A Devise extension to add additional security features required by modern web applications. Forked from Devise Security Extension

It is composed of 7 additional Devise modules:

  • :password_expirable - passwords will expire after a configured time (and will need an update). You will most likely want to use :password_expirable together with the :password_archivable module to prevent the current expired password being reused immediately as the new password.
  • :secure_validatable - better way to validate a model (email, stronger password validation). Don’t use with Devise :validatable module!
  • :password_archivable - save used passwords in an old_passwords table for history checks (don’t be able to use a formerly used password)
  • :session_limitable - ensures, that there is only one session usable per account at once
  • :expirable - expires a user account after x days of inactivity (default 90 days)
  • :security_questionable - as accessible substitution for captchas (security question with captcha fallback)
  • :paranoid_verification - admin can generate verification code that user needs to fill in otherwise he wont be able to use the application.

Configuration and database schema for each module below.

Additional features

  • captcha support for sign_up, sign_in, recover and unlock (to make automated mass creation and brute forcing of accounts harder)

Getting started

Devise Security works with Devise on Rails 4.1 onwards. You can add it to your Gemfile after you successfully set up Devise (see Devise documentation) with:

“by gem ‘devise-security’

Run the bundle command to install it.

After you installed Devise Security you need to run the generator:

“nsole rails generate devise_security:install

The generator adds optional configurations to config/initializers/devise-security.rb. Enable the modules you wish to use in the initializer you are ready to add Devise Security modules on top of Devise modules to any of your Devise models:

“by devise :password_expirable, :secure_validatable, :password_archivable, :session_limitable, :expirable

for :secure_validatable you need to add

“by gem ‘rails_email_validator’


“by Devise.setup do |config| # ==> Security Extension # Configure security extension for devise

# Should the password expire (e.g 3.months) # config.expire_password_after = 3.months

# Need 1 char each of: A-Z, a-z, 0-9, and a punctuation mark or symbol # config.password_complexity = { digit: 1, lower: 1, symbol: 1, upper: 1 }

# Number of old passwords in archive # config.password_archiving_count = 5

# Deny old password (true, false, count) # config.deny_old_passwords = true

# captcha integration for recover form # config.captcha_for_recover = true

# captcha integration for sign up form # config.captcha_for_sign_up = true

# captcha integration for sign in form # config.captcha_for_sign_in = true

# captcha integration for unlock form # config.captcha_for_unlock = true

# security_question integration for recover form # this automatically enables captchas (captcha_for_recover, as fallback) # config.security_question_for_recover = false

# security_question integration for unlock form # this automatically enables captchas (captcha_for_unlock, as fallback) # config.security_question_for_unlock = false

# security_question integration for confirmation form # this automatically enables captchas (captcha_for_confirmation, as fallback) # config.security_question_for_confirmation = false

# ==> Configuration for :expirable # Time period for account expiry from last_activity_at # config.expire_after = 90.days end


The captcha support depends on EasyCaptcha. See further documentation there.


  1. Add EasyCaptcha to your Gemfile with

    “by gem ‘easy_captcha’

  2. Run the initializer

    “by rails generate easy_captcha:install

  3. Enable captcha - see “Configuration” of Devise Security above.
  4. Add the captcha in the generated devise views for each controller you have activated


Maruku could not parse this XML/HTML: 
<p><%= captcha_tag %></p>