ruby on rails - Devise signs in an user even though it (in theory) never reached the sign_in method call -

i have attribute (approved) on user wish devise consider before allowing sign in.

i've overriden session controller , follows:

class sessionscontroller < devise::sessionscontroller   skip_after_filter :verify_authorized    def create      user = user.find_by_email(params[:user].try(:[], :email))      unless user.approved?       flash[:alert] = "login fail. account pending approval."       redirect_to :back , return     end      resource = warden.authenticate!(auth_options)     set_flash_message(:notice, :signed_in) if is_navigational_format?     sign_in(resource_name, resource)     respond_with resource, :location => after_sign_in_path_for(resource)   end    def failure     head 403   end end 

looking @ logic see there "redirect_to :back" happening, seems devise takes over, logs in user regardless of , redirects root (which i've setup redirect upon login)

i've never worked devise before , driving me mad. should return before reaching 'sign_in' part happening still signs in user regardless of unless block.

how go intercepting login if user.approved == false ?

thanks in advance!

although not same question, top answer in question applies here , fixed issue me.

check if user active before allowing user sign in devise (rails)