Ruby on rails -Devise - Require password to delete account -

currently users need enter password in order change email address or password, can delete account without entering it. not sure how require this.

so far have:

users controller:

def destroy     @user = user.find(current_user.id)     @user.destroy_with_password(user_params)       if @user.destroy           redirect_to root_url, notice: "user deleted."       else         redirect_to users_url         flash[:notice] = "couldn't delete"       end     end        def user_params          params.require(:user).permit(:username, :email, :password,                                       :password_confirmation, :current_password, :avatar, etc....etc.... )     end 

a form:

<%= simple_form_for(@user, :method => :delete) |f| %>       <%= f.input :current_password, autocomplete: "off" %>       <%= f.button :submit %> <% end %> 

here user deletes if no password inputted. delete request being processed correct controller action ;

processing userscontroller#destroy html  processing userscontroller#destroy html   parameters: {"utf8"=>"✓", "authenticity_token"=>"bla bla bla", "user"=>{"current_password"=>"[filtered]"}, "commit"=>"update user", "locale"=>"en", "id"=>"ce2dc2edc"}  sql (0.1ms)  delete "users" "users"."id" = $1  [["id", 15]] 

how can require user's password in order delete account?

you're calling devise's destroy_with_password and calling activerecord's destroy. need call destroy_with_password. code should read follows:

def destroy   @user = user.find(current_user.id)   if @user.destroy_with_password(user_params)   # if @user.destroy      # <== remove me, don't need destroy twice!       redirect_to root_url, notice: "user deleted."   else     redirect_to users_url     flash[:notice] = "couldn't delete"   end end 

destroy_with_password going return truthy value.