{"action":"created","issue":{"url":"https://api.github.com/repos/plataformatec/devise/issues/3431","labels_url":"https://api.github.com/repos/plataformatec/devise/issues/3431/labels{/name}","comments_url":"https://api.github.com/repos/plataformatec/devise/issues/3431/comments","events_url":"https://api.github.com/repos/plataformatec/devise/issues/3431/events","html_url":"https://github.com/plataformatec/devise/issues/3431","id":54727428,"number":3431,"title":"Devise shows misleading \"reset password token is invalid\" error when including authentication key in strip_whitespace_keys","user":{"login":"rockorequin","id":794677,"avatar_url":"https://avatars.githubusercontent.com/u/794677?v=3","gravatar_id":"","url":"https://api.github.com/users/rockorequin","html_url":"https://github.com/rockorequin","followers_url":"https://api.github.com/users/rockorequin/followers","following_url":"https://api.github.com/users/rockorequin/following{/other_user}","gists_url":"https://api.github.com/users/rockorequin/gists{/gist_id}","starred_url":"https://api.github.com/users/rockorequin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rockorequin/subscriptions","organizations_url":"https://api.github.com/users/rockorequin/orgs","repos_url":"https://api.github.com/users/rockorequin/repos","events_url":"https://api.github.com/users/rockorequin/events{/privacy}","received_events_url":"https://api.github.com/users/rockorequin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/plataformatec/devise/labels/Bug","name":"Bug","color":"ededed"},{"url":"https://api.github.com/repos/plataformatec/devise/labels/Needs%20more%20work","name":"Needs more work","color":"d7e102"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-01-19T05:24:51Z","updated_at":"2015-10-19T19:56:23Z","closed_at":null,"body":"With devise 3.4.1 (and also the latest from git as of 2015-01-19) and Rails 4.1.8, if I try to reset my password I get a misleading error message \"reset password token is invalid\" if I have this in the config/initializers/devise.rb file:\r\n\r\n<code>\r\nconfig.authentication_keys = [ :user_name ]\r\n</code>\r\n<code>\r\nconfig.strip_whitespace_keys = [ :user_name ]\r\n</code>\r\n\r\nI have stepped through the code and found that the encrypted token that Devise creates from the posted token matches the reset_password_token in the user record exactly, so \"reset password token is invalid\" is not actually the issue.\r\n\r\nInstead, what happens is that lib/devise/models/recoverable.rb#reset_password_by_token has this line:\r\n\r\n<code>\r\nrecoverable = find_or_initialize_with_error_by(:reset_password_token, reset_password_token)\r\n</code>\r\n\r\nand this method eventually calls lib/devise/parameter_filter.rb#filter to construct a conditions hash to find the user record using the reset_password_token that was calculated. However, this line in the filter method:\r\n\r\n<code>\r\nconditions.merge!(filtered_hash_by_method_for_given_keys(conditions.dup, :strip, @strip_whitespace_keys))\r\n</code>\r\n\r\nadds { user_name: nil } to the conditions hash, and as a result the find first method returns no user record (obviously since no records have a null authentication field in the database). Since the user record is null, reset_password_by_token then creates a new user record, which has the \"reset password token is invalid\" error in it.\r\n\r\nThe workaround is to remove the authentication key :user_name from the strip_whitespace_keys, and the error no longer occurs.\r\n\r\nIt might also be relevant that I have configured Devise to use the Person model (via \"devise_for :people...\" in config/routes.rb).\r\n\r\nAm I misusing the strip_whitespace_keys configuration? I don't see why devise insists on adding user_name to the conditions hash when it hasn't been passed user_name as an attribute to match.\r\n"},"comment":{"url":"https://api.github.com/repos/plataformatec/devise/issues/comments/149328527","html_url":"https://github.com/plataformatec/devise/issues/3431#issuecomment-149328527","issue_url":"https://api.github.com/repos/plataformatec/devise/issues/3431","id":149328527,"user":{"login":"topherfangio","id":54370,"avatar_url":"https://avatars.githubusercontent.com/u/54370?v=3","gravatar_id":"","url":"https://api.github.com/users/topherfangio","html_url":"https://github.com/topherfangio","followers_url":"https://api.github.com/users/topherfangio/followers","following_url":"https://api.github.com/users/topherfangio/following{/other_user}","gists_url":"https://api.github.com/users/topherfangio/gists{/gist_id}","starred_url":"https://api.github.com/users/topherfangio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/topherfangio/subscriptions","organizations_url":"https://api.github.com/users/topherfangio/orgs","repos_url":"https://api.github.com/users/topherfangio/repos","events_url":"https://api.github.com/users/topherfangio/events{/privacy}","received_events_url":"https://api.github.com/users/topherfangio/received_events","type":"User","site_admin":false},"created_at":"2015-10-19T19:56:23Z","updated_at":"2015-10-19T19:56:23Z","body":"@rockorequin Can you tell me if this was happening 100% of the time, or just sometimes? I am facing a similar issue in 3.5.2 and am trying to track down the exact issue; but it's not always happening."}}