title: Devise "Confirmation token is invalid" when user signs up
body: <p>Using Rails 4 and Devise 3.1.0 on my web app. I wrote a Cucumber test to test user sign up; it fails when the "confirm my account" link is clicked from the e-mail.</p>
  
  <pre><code>Scenario: User signs up with valid data                                                           # features/users/sign_up.feature:9
      When I sign up with valid user data                                                             # features/step_definitions/user_steps.rb:87
      Then I should receive an email                                                                  # features/step_definitions/email_steps.rb:51
      When I open the email                                                                           # features/step_definitions/email_steps.rb:76
      Then I should see the email delivered from "no-reply@mysite.com"                                # features/step_definitions/email_steps.rb:116
      And I should see "You can confirm your account email through the link below:" in the email body # features/step_definitions/email_steps.rb:108
      When I follow "Confirm my account" in the email                                                 # features/step_definitions/email_steps.rb:178
      Then I should be signed in                                                                      # features/step_definitions/user_steps.rb:142
        expected to find text "Logout" in "...Confirmation token is invalid..." (RSpec::Expectations::ExpectationNotMetError)
       ./features/step_definitions/user_steps.rb:143:in `/^I should be signed in$
  </code></pre>
  
  <p>This error is reproducible when I sign up manually through the web server as well, so it doesn't appear to be a Cucumber issue.</p>
  
  <p>I would like:</p>
  
  <ul>
  <li>The user to be able to one-click confirm their account through this e-mail's link</li>
  <li>Have the user stay signed in after confirming their account</li>
  </ul>
  
  <p>I have setup:</p>
  
  <ul>
  <li>The latest Devise code, from GitHub (3.1.0, ref 041fcf90807df5efded5fdcd53ced80544e7430f)</li>
  <li>A <code>User</code> class that implements <code>confirmable</code></li>
  <li>Using the 'default' confirmation controller (I have not defined my own custom one.)</li>
  </ul>
  
  <p>I have read these posts:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/18390080/devise-confirmation-token-is-invalid">Devise confirmation_token is invalid</a></li>
  <li><a href="http://blog.plataformatec.com.br/2013/08/devise-3-1-now-with-more-secure-defaults/" rel="nofollow noreferrer">Devise 3.1: Now with more secure defaults</a></li>
  <li><a href="https://github.com/plataformatec/devise/issues/2587" rel="nofollow noreferrer">GitHub Issue - Devise confirmation_token invalid</a></li>
  </ul>
  
  <p>And have tried:</p>
  
  <ul>
  <li>Setting <code>config.allow_insecure_tokens_lookup = true</code> in my Devise initializer, which throws an 'unknown method' error on startup. Plus it sounds like this is only supposed to be a temporary fix, so I'd like to avoid using it.</li>
  <li>Purged my DB and started from scratch (so no old tokens are present)</li>
  </ul>
  
  <p><strong>Update:</strong></p>
  
  <p>Checking the confirmation token stored on the <code>User</code> after registering. The emails token matches the DBs token. According to the posts above, the new Devise behavior says not supposed to, and that instead it is should generate a second token based on the e-mail's token. <em>This is suspicious.</em> Running <code>User.confirm_by_token('[EMAIL_CONFIRMATION_TOKEN]')</code> returns a User who has errors set "@messages={:confirmation_token=>["is invalid"]}", which appears to be the source of the issue.</p>
  
  <p>Mismatching tokens seems to be the heart of the issue; running the following code in console to manually change the User's confirmation_token causes confirmation to succeed:</p>
  
  <pre><code>new_token = Devise.token_generator.digest(User, :confirmation_token, '[EMAIL_TOKEN]')
  u = User.first
  u.confirmation_token = new_token
  u.save
  User.confirm_by_token('[EMAIL_TOKEN]') # Succeeds
  </code></pre>
  
  <p>So why is it saving the wrong confirmation token to the DB in the first place? I am using a custom registration controller... maybe there's something in it that causes it to be set incorrectly?</p>
  
  <p><strong>routes.rb</strong></p>
  
  <pre><code>  devise_for  :users,
            :path =&gt; '',
            :path_names =&gt; {
              :sign_in =&gt; 'login',
              :sign_out =&gt; 'logout',
              :sign_up =&gt; 'register'
              },
            :controllers =&gt; {
              :registrations =&gt; "users/registrations",
              :sessions =&gt; "users/sessions"
            }
  </code></pre>
  
  <p><strong>users/registrations_controller.rb</strong>:</p>
  
  <pre><code>class Users::RegistrationsController &lt; Devise::RegistrationsController
  
    def create
      # Custom code to fix DateTime issue
      Utils::convert_params_date_select params[:user][:profile_attributes], :birthday, nil, true
  
      super
    end
  
    def sign_up_params
      # TODO: Still need to fix this. Strong parameters with nested attributes not working.
      #       Permitting all is a security hazard.
      params.require(:user).permit!
      #params.require(:user).permit(:email, :password, :password_confirmation, :profile_attributes)
    end
    private :sign_up_params
  end
  </code></pre>