Issues

• Security issue: database_authenticatable is implicitly added by concern, allowing 2FA bypass with devise-two-factor

  lynndylanhurley/devise_token_auth#1682 · Filter by author fillipeppalhares opened on Mar 31, 2026

• Running into undefined method 'parse' for class CGI on Ruby 4.0.1

  lynndylanhurley/devise_token_auth#1680 · Filter by author kushagr3 opened on Mar 9, 2026

• ConfirmationsController doesn't use redirect_options properly

  lynndylanhurley/devise_token_auth#1679 · Filter by author newfylox opened on Mar 3, 2026

• Duration arithmetic mismatch in v1.2.6 causes newly created tokens to be immediately evicted with variable-length lifespans

  lynndylanhurley/devise_token_auth#1677 · Filter by author naanlizard opened on Mar 2, 2026
  1

• Cookie overflow

  lynndylanhurley/devise_token_auth#1673 · Filter by author sebfie opened on Nov 24, 2025

• Clean up unsupported Ruby versions and remove unnecessary files

  lynndylanhurley/devise_token_auth#1667 · Filter by author hatsu38 opened on Nov 1, 2025
  1

• Security issue disclosure

  close-in-7-days
  lynndylanhurley/devise_token_auth#1663 · Filter by author vlyv opened on Sep 19, 2025
  2

• Question/propostal: can we use SELECT ... FOR UPDATE SKIP LOCKED if using a "token buffer"?

  lynndylanhurley/devise_token_auth#1660 · Filter by author lucashungaro opened on Jul 23, 2025

• Previous tokens remain valid indefinitely, bypassing batch window throttle

  lynndylanhurley/devise_token_auth#1659 · Filter by author leightjohnson93 opened on Jul 16, 2025

• Omniauth redirect should send access-token not auth_token

  lynndylanhurley/devise_token_auth#1656 · Filter by author bettysteger opened on Jun 24, 2025

• Change logs with more meaningful information

  lynndylanhurley/devise_token_auth#1653 · Filter by author edusantana opened on Mar 27, 2025
  1

• set_user_token: Incompatibility between the Authorization header and having a param clashing with the auth header names.

  lynndylanhurley/devise_token_auth#1648 · Filter by author nicoraynaud opened on Jan 21, 2025

• Unable to destroy HttpOnly cookie when token expired in cookie_enabled mode

  lynndylanhurley/devise_token_auth#1631 · Filter by author justindoran opened on Jun 14, 2024

• Anonymous Login Feature Request

  lynndylanhurley/devise_token_auth#1630 · Filter by author hendrixgotcodes opened on Jun 10, 2024

• dta_find_by on wrong model with set_user_by_token

  lynndylanhurley/devise_token_auth#1629 · Filter by author stimlocy opened on Jun 3, 2024

• Possible to use Google oauth2 with devise_token_auth as well as devise?

  lynndylanhurley/devise_token_auth#1619 · Filter by author reisner opened on Apr 16, 2024

• Question about security.

  close-in-7-days
  lynndylanhurley/devise_token_auth#1615 · Filter by author ApoloIslaio opened on Nov 16, 2023
  1

• Refactoring : Confirmations controller - useless if redirect_url condition

  lynndylanhurley/devise_token_auth#1611 · Filter by author newfylox opened on Sep 29, 2023
  1

• Lockable does not work as expected

  lynndylanhurley/devise_token_auth#1610 · Filter by author CodeTectonics opened on Sep 24, 2023

• Sponsored issue: token authentication

  lynndylanhurley/devise_token_auth#1609 · Filter by author rockcoolsaint opened on Sep 20, 2023

• Suggestion: 2FA - New credentials validation method | Warden strategy

  lynndylanhurley/devise_token_auth#1605 · Filter by author newfylox opened on Aug 4, 2023

• question: Is the description of Methods correct?

  lynndylanhurley/devise_token_auth#1604 · Filter by author kotaesaki opened on Jun 21, 2023

• Add created_at attribute to each token

  lynndylanhurley/devise_token_auth#1603 · Filter by author nicholas-nicolau opened on Jun 14, 2023

• access-token header is blank when token isn't changed yet.

  lynndylanhurley/devise_token_auth#1597 · Filter by author dlikhten opened on May 2, 2023
  2

• set allow_password_change column in create_table file to null: false

  lynndylanhurley/devise_token_auth#1596 · Filter by author hatsu38 opened on Apr 27, 2023