Anton From Perm

EDIT: As I see, the issue has been fixed in the Git repository a few hours ago

I’ve been working lately with migrating my application to Rails 3 + MongoDB, which led me to use Devise instead of Authlogic. I ran into several issues while using Devise for a REST web service. In the case of an authentication error, Devise redirects requests to the login page instead of issuing a 401 unauthenticated.

The workaround is to use a custom failure app, and simply override the respond method as following:

class CustomFailure < Devise::FailureApp
  include ActionController::Head
  include ActionController::MimeResponds

  def respond
    respond_to do |format|
      format.html {
        super
      }
      format.any { head :status => 401}
    end
  end
end

And add the following in config/initializers/devise.rb:

Devise.setup do |config|
  config.warden do |manager|
    manager.failure_app = CustomFailure
  end
end