has_secure_password in Ruby on Rails - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What does has_secure_password add to a Rails model?

In a Rails model using has_secure_password, which of the following features is automatically added?

A It adds OAuth login support for third-party providers like Google and Facebook.

B It automatically encrypts all model attributes using AES encryption.

C It adds methods to set and authenticate against a BCrypt password, including <code>password=</code> and <code>authenticate</code>.

D It validates that the password is at least 12 characters long by default.

💡 Hint

Think about what has_secure_password does with the password field and authentication.

has_secure_password adds methods to set a password securely using BCrypt and to authenticate users by checking the password. It does not handle OAuth or encrypt all attributes.

📝 Syntax

intermediate

Which code snippet correctly enables has_secure_password in a Rails model?

Select the correct way to add has_secure_password to a Rails model named User.

A

class User < ApplicationRecord
  has_secure_password
end

B

class User < ApplicationRecord
  secure_password
end

C

class User < ApplicationRecord
  has_password_secure
end

D

class User < ApplicationRecord
  include HasSecurePassword
end

💡 Hint

The method name is exactly has_secure_password.

The correct syntax is to call has_secure_password inside the model class. Other options are invalid method names or modules.

❓ state_output

advanced

What is the value of user.authenticate('wrong') if the password is incorrect?

Given a User model with has_secure_password and a user with password 'secret', what does user.authenticate('wrong') return?

Ruby on Rails

user = User.new(password: 'secret', password_confirmation: 'secret')
user.save
result = user.authenticate('wrong')

A nil

B false

C true

D Raises an exception

💡 Hint

Check the documentation for authenticate return values on failure.

The authenticate method returns the user object if the password matches, otherwise it returns nil. It does not return false or raise errors.

🔧 Debug

advanced

Why does has_secure_password raise an error when the password_digest column is missing?

You added has_secure_password to your model but get an error about password_digest missing. Why?

A Because <code>has_secure_password</code> only works with <code>encrypted_password</code> column, not <code>password_digest</code>.

B Because <code>has_secure_password</code> requires a <code>password</code> column, not <code>password_digest</code>.

C Because the model must include <code>bcrypt</code> gem explicitly in the model file.

D Because <code>has_secure_password</code> requires a <code>password_digest</code> column to store the encrypted password.

💡 Hint

Think about where the encrypted password is stored in the database.

has_secure_password expects a password_digest column to save the hashed password. Without it, it cannot function and raises an error.

🧠 Conceptual

expert

How does has_secure_password improve security compared to storing plain passwords?

Why is using has_secure_password better for security than saving plain text passwords in the database?

A It encrypts passwords with a reversible cipher so admins can recover user passwords if needed.

B It hashes passwords with BCrypt, making it computationally expensive to reverse and protects against leaks.

C It stores passwords in plain text but hides them from the Rails console.

D It requires users to change passwords every day automatically.

💡 Hint

Think about what hashing means and why it is safer than plain text.

has_secure_password uses BCrypt to hash passwords. Hashing is one-way and slow, so even if the database leaks, attackers cannot easily get the original passwords.

Practice

1. What does has_secure_password add to a Rails model?

easy

A. Password encryption and authentication methods

B. Automatic email validation

C. Database indexing for passwords

D. User role management

Solution

1. Step 1: Understand the purpose of has_secure_password

   This method adds password encryption and authentication features to a model.

2. Step 2: Identify what it does not add

   It does not handle email validation, indexing, or roles.

3. Final Answer:

   Password encryption and authentication methods -> Option A

4. Quick Check:

   has_secure_password = Password encryption and authentication [OK]

Hint: Remember it handles passwords securely, not emails or roles [OK]

Common Mistakes:

• Thinking it validates emails
• Assuming it manages user roles
• Believing it creates database indexes

2. Which of the following is the correct way to enable has_secure_password in a Rails model?

easy

A. Add secure_password inside the model class

B. Add has_secure_password inside the model class

C. Add password_digest method inside the model

D. Add encrypt_password in the controller

Solution

1. Step 1: Recall the syntax for enabling password security

   The correct syntax is to call has_secure_password inside the model class.

2. Step 2: Eliminate incorrect options

   The other options use wrong method names or wrong places.

3. Final Answer:

   Add has_secure_password inside the model class -> Option B

4. Quick Check:

   Enable with has_secure_password in model = Add has_secure_password inside the model class [OK]

Hint: Use exact method name inside model class [OK]

Common Mistakes:

• Using wrong method names like secure_password
• Trying to add password_digest as a method
• Placing password logic in controller

3. Given this model code:

class User < ApplicationRecord
  has_secure_password
end

And this code:

user = User.new(password: 'secret', password_confirmation: 'secret')
user.save
user.authenticate('secret')

What will user.authenticate('secret') return?

medium

A. nil

B. false

C. The user object

D. An error

Solution

1. Step 1: Understand authenticate behavior

   It returns the user object if the password matches.

2. Step 2: Check password and confirmation match

   Since password and confirmation are both 'secret', save succeeds and authenticate returns user.

3. Final Answer:

   The user object -> Option C

4. Quick Check:

   Correct password authenticates user object [OK]

Hint: authenticate returns user if password matches, else false [OK]

Common Mistakes:

• Expecting authenticate to return true/false only
• Confusing nil and false return values
• Ignoring password confirmation

4. You added has_secure_password to your model but get this error when saving: ActiveModel::MissingAttributeError: can't write unknown attribute `password_digest`. What is the likely cause?

medium

A. You did not validate password presence

B. You did not call has_secure_password in the model

C. You used password instead of password_digest in the form

D. You forgot to add the password_digest column to the database

Solution

1. Step 1: Understand the error meaning

   The error says the model cannot write to password_digest attribute because it does not exist.

2. Step 2: Identify missing database column

   has_secure_password requires a password_digest column in the database table.

3. Final Answer:

   You forgot to add the password_digest column to the database -> Option D

4. Quick Check:

   Missing password_digest column causes this error [OK]

Hint: Add password_digest column to fix this error [OK]

Common Mistakes:

• Thinking it's a missing method call
• Confusing form field names with database columns
• Assuming validation causes this error

5. You want to create a User model with secure passwords and also ensure users can only update their password if they provide the current password correctly. Which approach correctly combines has_secure_password with this logic?

hard

A. Use has_secure_password and add a custom method to verify current password before update

B. Use has_secure_password and override authenticate to check current password

C. Add password_digest column but handle password encryption manually

D. Use has_secure_password and skip password confirmation validation

Solution

1. Step 1: Understand has_secure_password role

   It provides password encryption and authentication but does not enforce current password checks on update.

2. Step 2: Implement custom logic for current password verification

   You must add a method that checks the current password before allowing password update.

3. Step 3: Evaluate options

   Use has_secure_password and add a custom method to verify current password before update correctly combines has_secure_password with custom verification. Use has_secure_password and override authenticate to check current password incorrectly suggests overriding authenticate. Add password_digest column but handle password encryption manually ignores has_secure_password benefits. Use has_secure_password and skip password confirmation validation weakens security.

4. Final Answer:

   Use has_secure_password and add a custom method to verify current password before update -> Option A

5. Quick Check:

   Combine has_secure_password with custom current password check [OK]

Hint: Add custom method to check current password before update [OK]

Common Mistakes:

• Overriding authenticate method incorrectly
• Handling encryption manually instead of using has_secure_password
• Skipping password confirmation validation