session - Rails : Devise with config.session_store :disabled -

i building restful api stateless rails 3 , gem devise.

since don't want store session, have disabled them defining in config/initializers/session_store.rb :

myapp::application.config.session_store :disabled 

all warden strategies (http basic auth, token auth) don't store information (stored? returns false).

i using in controllers helper authenticate_user! before_filter. obtain following error during authentication:

nomethoderror (undefined method `[]' nil:nilclass) : warden (1.2.1) lib/warden/session_serializer.rb:32:in `fetch' warden (1.2.1) lib/warden/proxy.rb:212:in `user' warden (1.2.1) lib/warden/proxy.rb:318:in `_perform_authentication'     warden (1.2.1) lib/warden/proxy.rb:127:in `authenticate!' devise (2.2.3) lib/devise/controllers/helpers.rb:48:in `authenticate_user!' 

the code in session_serializer @ line 32 following method:

def fetch(scope)   key = session[key_for(scope)] # crashes here   return nil unless key    method_name = "#{scope}_deserialize"   user = respond_to?(method_name) ? send(method_name, key) : deserialize(key)   delete(scope) unless user   user end 

it crashes because session (ie @env['rack.sessions']) equals nil (session_store indeed disabled). default call, strategies have not been called yet.

since don't want monkey patch, looking way achieve session_store disabled.

thanks

if open dropping devise, i'd suggest authenticating token. token authentication can set-up in rails , validate requests passing token each request header.

authorization : token token="xxx"

i've tacked on default rails api token authentication code if interested.

class applicationcontroller < actioncontroller::base   protect_from_forgery     private   def restrict_access     authenticate_with_http_token |token, options|       user.exists?(authentication_token: token)     end   end    private   def api_user     authenticate_with_http_token |token, options|       user.find_by_authentication_token(token)     end   end end  class userscontroller < applicationcontroller   before_filter :restrict_access, :except => ['create']    def create     user=user.create(:email=>params[:email],                      :password=>params[:password],                      :password_confirmation=>params[:password_confirmation])    end end  class tokenscontroller < applicationcontroller   respond_to :json    def create   user = user.authenticate(params[:email],params[:password])   if user     render :json => user.find_by_email(params[:email])   else     render :json => "#{params[:email]} not authorized.", :status => 401   end end  class user < activerecord::base    attr_accessible :email, :authentication_token   attr_accessor :password, :password_confirmation    def self.authenticate(email, password)     user= find_by_email(email)     user && user.password_hash == bcrypt::engine.hash_secret(password, user.password_salt) ? user : nil   end   private   def generate_authentication_token     begin       self.authentication_token = securerandom.hex     end while self.class.exists?(authentication_token: authentication_token)     self.last_sign_in_at=datetime.now     self.sign_in_count=self.sign_in_count+1   end    private   def encrypt_password     if password.present?       self.password_salt = bcrypt::engine.generate_salt       self.password_hash = bcrypt::engine.hash_secret(password,password_salt)     end   end end