Question

how can I make devise enforce getting correct password before canceling registration (deleting account)

Answer 1

You can either:

1. Do something along the lines of pst’s answer: have a text box for :canceled in a form that when saved, cancels the account. Since it would be part of the user model, devise would force the password check upon the update action.

2. Do it yourself via a button that warns (similar to the delete buttons often in Rails). The controller that receives the request would simply do something like the following (I seem to remember that Devise uses MD5, maybe it’s SHA1, SHA2, unsure- see documentation; the key is to use the same type):

   if params[:password] == Digest::MD5.hexdigest(params[:password])
   cancel_account(…)
   …
   end