{"action":"closed","issue":{"url":"https://api.github.com/repos/plataformatec/devise/issues/3763","labels_url":"https://api.github.com/repos/plataformatec/devise/issues/3763/labels{/name}","comments_url":"https://api.github.com/repos/plataformatec/devise/issues/3763/comments","events_url":"https://api.github.com/repos/plataformatec/devise/issues/3763/events","html_url":"https://github.com/plataformatec/devise/issues/3763","id":108281529,"number":3763,"title":"current_user found before sign_in","user":{"login":"forever-ram","id":6013511,"avatar_url":"https://avatars.githubusercontent.com/u/6013511?v=3","gravatar_id":"","url":"https://api.github.com/users/forever-ram","html_url":"https://github.com/forever-ram","followers_url":"https://api.github.com/users/forever-ram/followers","following_url":"https://api.github.com/users/forever-ram/following{/other_user}","gists_url":"https://api.github.com/users/forever-ram/gists{/gist_id}","starred_url":"https://api.github.com/users/forever-ram/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/forever-ram/subscriptions","organizations_url":"https://api.github.com/users/forever-ram/orgs","repos_url":"https://api.github.com/users/forever-ram/repos","events_url":"https://api.github.com/users/forever-ram/events{/privacy}","received_events_url":"https://api.github.com/users/forever-ram/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-25T08:08:02Z","updated_at":"2015-10-14T22:36:47Z","closed_at":"2015-10-14T22:36:47Z","body":"Hi\r\nI've override the create action of session controller in my app for write the my own code for sign in.\r\nI've captcha validation code in my create action but if I provide an invalid captcha still I get signed in and got the current_user.\r\n\r\nhere is my controller code \r\n\r\n    class SessionsController < Devise::SessionsController\r\n      def create\r\n        if captcha_valid? params[:captcha]\r\n          super\r\n        else\r\n          sign_out\r\n          flash[:error] = \"Captcha code is not valid.\"\r\n          redirect_to new_user_session_path\r\n        end\r\n      end\r\n    end\r\n\r\nMy User model \r\n\r\n    class User < ActiveRecord::Base\r\n      acts_as_paranoid\r\n      has_paper_trail :ignore => [:sign_in_count, :current_sign_in_at, :last_sign_in_at, :current_sign_in_ip, :last_sign_in_ip, :confirmed_at]\r\n\r\n      attr_accessor :current_step\r\n      # Include default devise modules. Others available are:\r\n      # :confirmable, :lockable, :timeoutable and :omniauthable\r\n      devise :database_authenticatable,# :registerable,\r\n         :recoverable, :rememberable, :trackable, :validatable\r\n    end\r\n\r\nwhen my control come to the create action if I check for current_user I got the user who's email/ password I've provide in sign in form\r\n\r\nI think the `create` action not override properly and it call the default `create` action first and than come to my local `create` action \r\nI don't know what exactly happening, please let me know what I'm doing wrong."}}