devise: Rails 7 data-confirm not working for User deletion

Environment

Ruby 3.0.3p157
Rails 7.0.0
Devise 4.8.1

Current behavior

When clicking the default “Cancel my account” link, the data-confirm is not triggering, and instead it is deleting the user account right away. I am using Rails 7 with turbo / stimulus / importmap, although I have data-turbo set to false for my edit user form. Here is the form code:

<%= form_for(resource, as: resource_name, url: registration_path(resource_name), html: { method: :put, 'data-turbo': false }) do |f| %>
  <%= render DeviseErrorsComponent.new(resource: resource) %>

  <div class="md:flex md:space-x-4">
    <div class="flex-1">
      <div class="o-control-group">
        <%= f.label :first_name, class: "o-label" %>
        <%= f.text_field :first_name, autofocus: true, autocomplete: 'disabled', class: "o-input" %>
      </div>
    </div>

    <div class="flex-1">
      <div class="o-control-group">
        <%= f.label :last_name, class: "o-label" %>
        <%= f.text_field :last_name, autocomplete: 'disabled', class: "o-input" %>
      </div>
    </div>
  </div>

  <div class="o-control-group">
    <%= f.label :timezone, class: "o-label" %>
    <%= f.time_zone_select :timezone, ActiveSupport::TimeZone.us_zones, { default: "Eastern Time (US & Canada)" }, { class: "o-input" } %>
  </div>
  
  <div class="o-control-group">
    <%= f.label :email, class: "o-label" %>
    <%= f.email_field :email, placeholder: "john@gmail.com", autocomplete: "email", class: "o-input" %>
  </div>

  <% if devise_mapping.confirmable? && resource.pending_reconfirmation? %>
    <div>Currently waiting confirmation for: <%= resource.unconfirmed_email %></div>
  <% end %>

  <div class="o-control-group">
    <%= f.label :current_password, class: "o-label" %>
    <%= f.password_field :current_password, autocomplete: "current-password", placeholder: "●●●●●●●●", class: "o-input" %>
    <div class="ml-2 mt-2 text-sm font-semibold text-gray-400">Your current password is required to confirm your changes</div>
  </div>

  <div class="text-center">
    <%= f.submit "Update", class: "o-btn o-btn--primary w-1/3" %>
    <div class="mt-4 text-sm text-gray-400">Unhappy? <%= button_to "Close account", registration_path(resource_name), data: { confirm: "Are you sure?" }, method: :delete , class: "o-link o-link--primary" %></div>
  </div>
<% end %>

The data: { confirm: "Are you sure?" } bit does not seem to be doing anything in my setup.

Expected behavior

Clicking the “Cancel my account” link prompts the user to confirm before their account is deleted.

About this issue

Original URL
State: closed
Created 2 years ago
Comments: 24 (5 by maintainers)

Commits related to this issue

회원 탈퇴 오류 수정 https://github.com/heartcombo/devise/issues/5448 — committed to joyfuI/gagyebu by joyfuI 2 years ago
Integrate with Hotwire/Turbo by configuring error and response statuses Treat `:turbo_stream` request format as a navigational format, much like HTML, so Devise/responders can work properly. Allow c... — committed to heartcombo/devise by carlosantoniodasilva a year ago
Integrate with Hotwire/Turbo by configuring error and response statuses Treat `:turbo_stream` request format as a navigational format, much like HTML, so Devise/responders can work properly. Allow c... — committed to heartcombo/devise by carlosantoniodasilva a year ago
Integrate with Hotwire/Turbo by configuring error and response statuses Treat `:turbo_stream` request format as a navigational format, much like HTML, so Devise/responders can work properly. Allow c... — committed to heartcombo/devise by carlosantoniodasilva a year ago
Integrate with Hotwire/Turbo by configuring error and response statuses Treat `:turbo_stream` request format as a navigational format, much like HTML, so Devise/responders can work properly. Allow c... — committed to heartcombo/devise by carlosantoniodasilva a year ago

Most upvoted comments

Can you try this

<%= button_to "Delete my account", registration_path(resource_name), form: { data: { turbo_confirm: "Are you sure?" } }, method: :delete %>

+38

spaquet on Jan 12, 2022

https://twitter.com/excid3/status/1471241559085617154

+10

nejdetkadir on Jan 6, 2022

Can you try this

<%= button_to "Delete my account", registration_path(resource_name), form: { data: { turbo_confirm: "Are you sure?" } }, method: :delete %>

Having a similar issue on Rails 7.0.0. Can confirm that form: { data: { turbo_confirm: 'message' }} works as expected. (Or, if using link_to, just data: { turbo_confirm: 'message' }). Thanks for the hint @nejdetkadir & @spaquet !

mdorr on Jan 14, 2022

ruby 3.1.2 Rails 7.0.4 This work for me <%= button_to “Destroy”, friend, method: :delete, data: {“turbo-confirm”: ‘Are you sure?’} %>

sumantind on Nov 18, 2022

The problem seems to be gone! I just removed the following statements from the file /rails-app/app/javascript/application.js (I’m using importmap and already pinned the libraries in file /rails-app/config/importmap.rb):

import "popper"
import "bootstrap"

However, IMHO adding in Devise an option to send a confirmation email to the user in order to delete his/her account would be good.

lapser on Mar 7, 2023

Stumbled upon this while trying to fix a similar issue. https://stackoverflow.com/a/70482989/195509 solved it for me with:

<%= link_to 'Delete', your_path_here, data: { "turbo-method": :delete, "turbo-confirm": 'Are you sure?' } %>

alexbevi on Nov 21, 2022

None of the above is working for me. and I am using rails 7.0.4

TadesseDev on Sep 27, 2022

@Hombre2014 Not sure that that could be then… is that the only button not working with confirmation? That’s basically Turbo behavior so it should be nothing Devise specific.

In my test app I have that exact same code:

<%= button_to "Cancel my account", registration_path(resource_name), 
  data: { confirm: "Are you sure?", turbo_confirm: "Are you sure?" }, method: :delete %>

And it works fine:

https://user-images.githubusercontent.com/26328/221231040-a571fec7-7414-49e0-a8f0-23a67527df08.mp4

Even if I remove the “confirm” and leave only “turbo_confirm”, the HTML I get is this and it works:

<button data-turbo-confirm="Are you sure?" type="submit">Cancel my account</button>

Also using turbo-rails 1.3.3:

% bundle info turbo
  * turbo-rails (1.3.3)
	Summary: The speed of a single-page web application without having to write any JavaScript.
	Homepage: https://github.com/hotwired/turbo-rails

Sorry I can’t be of more help there, confirmation is a Turbo feature and nothing Devise interferes with.

carlosantoniodasilva on Feb 24, 2023

ami no me funciona y estoy trabajando con esa version de rails 7 los men sajes de confirmacion

<%= link_to “Salir”, destroy_user_session_path, form: { data: { turbo_confirm: “Are you sure?” } },:method => :delete, class: “salir”%>

Gustavovaldezurango on Jun 22, 2022

Also as a side-note, the config/routes.rb will need to handle the redirect following the deletion of the user. I found this write-up to be helpful 👍🏻

tokyodaruma on Jan 30, 2022