title: Devise + Angular + Rails 4 : Changing Logged-in user not validating username/password
body: <p>...So close to desired behavior!</p>
  
  <p>Have a Devise / AngularJS / Rails 4 project where the user login/logout is working nearly perfectly. Sending back the X-CSRF-Token and storing the user's email in angular as a cookie so that user hitting refresh doesn't cause angular to lose knowledge of the user.</p>
  
  <p>Only problem I can see is this:  If you are logged in as an admin user then, <em>WITHOUT logging out</em>... You just fill in the username/login with some other valid credentials... Devise is authenticating you based on your CSRF token instead of actually validating that username and password.  </p>
  
  <p>Therefore, you'll think you are logged in as someone else, but you are actually the previously-logged-in user.  I'm sure this is pretty simple, but just can't seem to nail it... need to force devise/warden to <strong>always check username/password on the CREATE</strong> - don't just be happy with the csrf token.</p>
  
  <p>Here is our sessions_controller.rb:</p>
  
  <pre><code>class SessionsController &lt; Devise::SessionsController
    respond_to :json
    def create
      Rails.logger.debug("(SessionsController.create) ******* ")
      user = warden.authenticate!(:scope =&gt; :user, :recall =&gt; "#{controller_path}#failure")
      Rails.logger.debug("(SessionsController.create) back from warden.authenticate ")
      render :status =&gt; 200,
        :json =&gt; { :success =&gt; true,
                   :info =&gt; "Logged in",
                   :user =&gt; current_user
        }
    end
  
    def destroy
      warden.authenticate!(:scope =&gt; :user, :recall =&gt; "#{controller_path}#failure")
      sign_out
      render :status =&gt; 200,
             :json =&gt; { :success =&gt; true,
                        :info =&gt; "Logged out",
             }
    end
  
    def failure
      render :status =&gt; 401,
             :json =&gt; { :success =&gt; false,
                        :info =&gt; "Login Credentials Failed"
             }
    end
  
    def show_current_user
      warden.authenticate!(:scope =&gt; :user, :recall =&gt; "#{controller_path}#failure")
      render :status =&gt; 200,
             :json =&gt; { :success =&gt; true,
                        :info =&gt; "Current User",
                        :user =&gt; current_user
  
             }
    end
  end
  </code></pre>
  
  <p>Here is application_controller.rb:</p>
  
  <pre><code>class ApplicationController &lt; ActionController::Base
    protect_from_forgery #with: :exception
    helper_method :require_user, :require_admin
  
    after_filter :set_csrf_cookie_for_ng
  
    def set_csrf_cookie_for_ng
      Rails.logger.debug("set_csrf_cookie_for_ng called FAT:#{form_authenticity_token}")
      Rails.logger.debug("protect_against_forgery = #{protect_against_forgery?}")
      cookies['XSRF-TOKEN'] = form_authenticity_token if protect_against_forgery?
    end
  
    def require_user
      Rails.logger.debug("require_user method in application controller")
      if !user_signed_in?
          flash[:notice] = "Please sign in!"
          redirect_to new_user_session_path
      end
    end
  
    def is_admin_user
      return false if current_user.nil?
      return current_user.admin?
    end
  
    def is_any_user
      return false if current_user.nil?
      return user_signed_in?
    end
  
    def verify_admin_user
      unless is_admin_user
        Rails.logger.debug("Unauthorized - Must be Admin")
        respond_to do | format |
          format.json { render :json =&gt; [], :status =&gt; :unauthorized }
        end
      end
    end
  
    def verify_any_user
      unless user_signed_in?
        Rails.logger.debug("Unauthorized - Must be Logged-in")
        respond_to do | format |
          format.json { render :json =&gt; [], :status =&gt; :unauthorized }
        end
      end
    end
  
    protected
  
    def verified_request?
      Rails.logger.debug("verified_request called f_a_t:#{form_authenticity_token}. X-XSRF-TOKEN:#{request.headers['X-XSRF-TOKEN']}")
      super || form_authenticity_token == request.headers['X-XSRF-TOKEN']
    end
  end
  </code></pre>
  
  <p>Routes.rb:</p>
  
  <pre><code>devise_for :users, :controllers =&gt; {:sessions =&gt; "sessions"}
  </code></pre>
  
  <p>Finally, on the Angularjs side, our httpprovider:</p>
  
  <pre><code>  .config(["$httpProvider", ($httpProvider) -&gt;
      $httpProvider.defaults.headers.common["X-CSRF-Token"] = $("meta[name=csrf-token]").attr("content")
  </code></pre>
  
  <p>Here is what I see going by in the logs if you were logged-in as an admin, then you attempt to "login-over" as a non admin... Note that "user 1" is the admin who was logged-in already.</p>
  
  <pre><code>Started POST "/users/sign_in.json" for 127.0.0.1 at 2014-06-02 23:21:25 -0500
  Processing by SessionsController#create as JSON
    Parameters: {"user"=&gt;{"email"=&gt;"nonadmin@example.com", "password"=&gt;"[FILTERED]"}, "session"=&gt;{"user"=&gt;{"email"=&gt;"nonadmin@example.com", "password"=&gt;"[FILTERED]"}}}
  verified_request called f_a_t:P2FZxg/qwooeNp0Ttme8urXoM9tzWh1bO5y28J8rTHc=. X-XSRF-TOKEN:P2FZxg/qwooeNp0Ttme8urXoM9tzWh1bO5y28J8rTHc=
  (SessionsController.create) ******* 
    User Load (0.5ms)  SELECT "users".* FROM "users" WHERE "users"."id" = 1 ORDER BY "users"."id" ASC LIMIT 1
  (SessionsController.create) back from warden.authenticate 
  set_csrf_cookie_for_ng called FAT:P2FZxg/qwooeNp0Ttme8urXoM9tzWh1bO5y28J8rTHc=
  protect_against_forgery = true
  Completed 200 OK in 3ms (Views: 0.8ms | ActiveRecord: 0.5ms)
  </code></pre>
  
  <p>Appreciate any help!</p>