plataformatec/devise — pull request #2269 by drewish (2013-02-08 01:59:56+00:00)
Title: Only skip session timeout check for create and destroy.

My understanding of the code is that when a user hits the login page with an expired session, they get redirected to `signed_in_root_path` where the expired session is detected, causing them to be redirected back to the login page. It seems like it would be more efficent to just check the expiration in the first place and avoid the redirect cycle.

We discovered this on a site where we're using devise to authenticate users as part of an an OAuth flow. We discovered that if the user had logged in, waited for the session to expire, and then specifically loaded the sign in page (hitting `Devise::SessionsController#new`), they'd be redirected right through into the OAuth flow without being timed out. We tracked it down to the fact that we'd overridden `after_sign_in_path_for` to send them off to the right callback URL. In that case,
`request.env["devise.skip_timeout"]` is true, the `require_no_authentication` filter redirects them through the OAuth flow, and the session never expires.

We'd worked around it by just removing the filter e.g. `_process_action_callbacks.reject! {|cb| cb.raw_filter.is_a?(Proc) }` which seemed a little more hacky than it needed to be since the filter was a proc rather than a symbol.