title: Devise Custom Strategies: Still Setting Session Cookies
body: <p>I am using Devise to authenticate users to my Ruby on Rails application. Up to this point, I have been using the standard Cookie-based session to authenticate users, but now I have requirements to allow a token-based authentication, and I implemented this through a <a href="http://kyan.com/blog/2013/10/11/devise-authentication-strategies" rel="nofollow">custom <strong>Warden</strong> strategy</a>.</p>
  
  <p>For the sake of this example, my custom strategy code is:</p>
  
  <pre><code>module Devise
    module Strategies
      class CustomAuthenticatable &lt; Base
        def valid?
          params.has_key? :email
        end 
  
        def authenticate!
          success!(User.find_by(email: params[:email]))
          #fail
        end 
      end 
    end 
  end
  </code></pre>
  
  <p>So this works as expected for the first request: when I <code>GET /api/my_controller/url?email=user@example.com</code> the user is authenticated, and I get the expected response.</p>
  
  <p><strong>But wait:</strong> when I then make a second request: <code>GET /api/my_controller/url</code>, the user is still authenticated.</p>
  
  <p>Upon further inspection, I see that a <code>Set-Cookie</code> is being sent, with a Devise session.</p>
  
  <h2>So here's my question:</h2>
  
  <p>How do I disable the <code>Set-Cookie</code> when using a custom strategy?</p>