Devise logging out automatically after password change

In Devise, if I change user's password and after it gets updated in the db, the site immediately logs out the user. I don't want this behavior - how do i do that. please help.

I had the same problem and the following code seems to work for me.

Assume that the passwords controller is set for a singleton route. Also, assume that the authenticated model is an Account. With that, you have the following:

def update
  if current_account.update_with_password(params[:account])
    sign_in(current_account, :bypass => true)
    flash[:notice] = 'Password updated.'
    redirect_to account_path
  else
    render :action => :show
  end
end

The key ingredient is the sign_in method call which seeks to re-sign-in the account, but bypasses the warden callbacks and stores the account into the session.

The example above did not work for me using multiple scopes in Devise.

I had to add the scope/resource name in the sign_in path for it to work, and to prevent chaos I also had to sign out the old user or else all kinds of confusion would abound.

The changes I had to make would look something like this using the above example.

def update
   if current_account.update_with_password(params[:account])
     sign_out(current_account)
     sign_in(:account, current_account, :bypass => true)
     flash[:notice] = 'Password updated.'
     redirect_to account_path
   else
     render :action => :show
   end
end

Edit to add: I believe I had to forcibly sign out the user because somewhere I overrode Devise's code in order not to have users sign out during certain actions. In hindsight; not a good idea! This approach is much better! Being that it is safer to make your own Controllers versus overriding Devise's code unless it's absolutely unavoidable.

You can simply set sign_in_after_reset_password in your devise.rb

config.sign_in_after_reset_password = true

Edit: As of 2020 this defaults to true

Use this code to avoid sign out.

sign_in(current_user, :bypass => true)

Update to Bill Eisenhauer answer above-

sign_in(current_account, :bypass => true) has been deprecated use bypass_sign_in current_account instead

More details can be found here http://www.rubydoc.info/github/plataformatec/devise/Devise/Controllers/SignInOut#bypass_sign_in-instance_method

Add the following piece of code to your method in which you are updating the user's password, right after updating the user's password in the database:

def update
 . . . . .<your code>
 . . . . .<your code>

 sign_in(@user, :bypass => true)

 . . . . .<your code>
 . . . . .<your code>
end

For some reasons, current_user is not equal to @user although current_user.id is equal to @user.id. So I have to use sign_in(@user, :bypass => true).

Please refer to this answer here, I tried all the above answers. It din't work for not adding the scope. https://stackoverflow.com/a/30418266/4973585

This doesn't work - sign_in @user, bypass: true

This works - sign_in :user, @user, bypass: true

Use the registerable module, which will give you both sign up and edit user features

https://github.com/plataformatec/devise/wiki/How-To:-Allow-users-to-edit-their-password