Devise (via API) recoverable : reset_password_token can't be blank
<p>I found some discussions and topics about the recoverable feature, but couldn't fix the issue I encounter. </p>

<p>I have a front end API that uses a rails 3.2 backend ( with Devise 2.2.4)
all routes are working well but when I try to update the password it sends a json resonse (in Postman ) : </p>

<pre><code>"reset_password_token" : "can't be blank"
</code></pre>

<p>If I understand the feature : </p>

<p>1- The POST # POST /resource/password sends the reset password to the email ( used as param )
2- then I perform a GET /resource/password/edit?reset_password_token=abcdef that goes to my FrontEnd page with a password input.
3- when the password is changed I launch a # PUT /resource/password</p>

<p>This is where the error occures.</p>

<p>Here is the password_controller.rb file : </p>

<pre><code>class Devise::PasswordsController &lt; DeviseController
  prepend_before_filter :require_no_authentication
  # Render the #edit only if coming from a reset password email link
  append_before_filter :assert_reset_token_passed, :only =&gt; [:edit, :update]

# GET /resource/password/new
def new
  build_resource({})
end

# POST /resource/password
def create
  self.resource = resource_class.send_reset_password_instructions(resource_params)

  if successfully_sent?(resource)
    #respond_with({}, :location =&gt; after_sending_reset_password_instructions_path_for(resource_name))
    render json: { message: "mail sent"}, status: 200
  else
    #respond_with(resource)
    render json: { :status }
  end
 end

 # GET /resource/password/edit?reset_password_token=abcdef
 def edit
  self.resource = resource_class.new
  resource.reset_password_token = params[:reset_password_token]
 end

 # PUT /resource/password
 def update
  self.resource = resource_class.reset_password_by_token(params[:reset_password_token])
  if resource.errors.empty?
  resource.unlock_access! if unlockable?(resource)
  flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
  set_flash_message(:notice, flash_message) if is_navigational_format?
  #sign_in(resource_name, resource)
  #respond_with resource, :location =&gt; after_resetting_password_path_for(resource)
  render json: { message: "password updated"}, status: 200
 else
  respond_with resource
 end
end

protected
 def after_resetting_password_path_for(resource)
  after_sign_in_path_for(resource)
 end

# The path used after sending reset password instructions
def after_sending_reset_password_instructions_path_for(resource_name)
  new_session_path(resource_name) if is_navigational_format?
end

# Check if a reset_password_token is provided in the request
def assert_reset_token_passed
  if params[:reset_password_token].blank?
    #set_flash_message(:error, :no_token)
    #redirect_to new_session_path(resource_name)
    render json: { message: "reset password is not blank"}, status: 200
  end
end

# Check if proper Lockable module methods are present &amp; unlock strategy
# allows to unlock resource on password reset
def unlockable?(resource)
  resource.respond_to?(:unlock_access!) &amp;&amp;
    resource.respond_to?(:unlock_strategy_enabled?) &amp;&amp;
    resource.unlock_strategy_enabled?(:email)
end
end
</code></pre>

<p>The recoverable.rb method reset_password_by_token :</p>

<pre><code>   def reset_password_by_token(attributes={})
      recoverable = find_or_initialize_with_error_by(:reset_password_token, attributes[:reset_password_token])
      if recoverable.persisted?
        if recoverable.reset_password_period_valid?
          recoverable.reset_password!(attributes[:password], attributes[:password_confirmation])
      else
        recoverable.errors.add(:reset_password_token, :expired)
      end
    end
    recoverable
  end

  Devise::Models.config(self, :reset_password_keys, :reset_password_within)
</code></pre>

<p>I tried to add some puts on the methods and they are not thrown in the backlog. 
Here is my rails s log : </p>

<pre><code>Started PUT "/users/password" for 192.168.0.18 at 2016-04-06 09:35:11 +0200
Processing by Devise::PasswordsController#update as JSON
Parameters: {"reset_password_token"=&gt;"[FILTERED]", "password"=&gt;"[FILTERED]"}
, :options=&gt;{:count=&gt;1, :default=&gt;["User"]}, :description=&gt;"User"}, {:key=&gt;"activerecord.attributes.user.confirmation_token", :locale=&gt;:en, :options=&gt;{:count=&gt;1, :default=&gt;[:"attributes.confirmation_token", "Confirmation token"]}, :description=&gt;"Confirmation token"}, {:key=&gt;"activerecord.attributes.user.unconfirmed_email", :locale=&gt;:en, :options=&gt;{:count=&gt;1, :default=&gt;[:"attributes.unconfirmed_email", "Unconfirmed email"]}, :description=&gt;"Unconfirmed email"}, {:key=&gt;"activerecord.attributes.user.email", :locale=&gt;:en, :options=&gt;{:count=&gt;1, :default=&gt;[:"attributes.email", "Email"]}, :description=&gt;"Email"}, {:key=&gt;"activerecord.attributes.user.reset_password_token", :locale=&gt;:en, :options=&gt;{:count=&gt;1, :default=&gt;[:"attributes.reset_password_token", "Reset password token"]}, :description=&gt;"Reset password token"}]}
Completed 422 Unprocessable Entity in 2174ms (Views: 0.4ms | ActiveRecord: 1.6ms)
</code></pre>

<p>===================</p>

<p><em>EDIT</em></p>

<p>===================</p>

<p>To understand where the request comes from I add below the PUT request on Angular/FrontEnd part : </p>

<pre><code>  users.newPassword = function (token, password) {
    var putData = {
     user:{
       reset_password_token: token,
       password: password
     }
  };
  return Restangular.withConfig(function(RestangularConfigurer) {
    RestangularConfigurer.setFullResponse(true);
    }).one('/users/password').customPUT(putData);
  };
</code></pre>