has_secure_password in Ruby on Rails - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What does has_secure_password add to a Rails model?

In a Rails model using has_secure_password, which of the following features is automatically added?

A It adds OAuth login support for third-party providers like Google and Facebook.

B It automatically encrypts all model attributes using AES encryption.

C It adds methods to set and authenticate against a BCrypt password, including <code>password=</code> and <code>authenticate</code>.

D It validates that the password is at least 12 characters long by default.

💡 Hint

Think about what has_secure_password does with the password field and authentication.

has_secure_password adds methods to set a password securely using BCrypt and to authenticate users by checking the password. It does not handle OAuth or encrypt all attributes.

📝 Syntax

intermediate

Which code snippet correctly enables has_secure_password in a Rails model?

Select the correct way to add has_secure_password to a Rails model named User.

A

class User < ApplicationRecord
  has_secure_password
end

B

class User < ApplicationRecord
  secure_password
end

C

class User < ApplicationRecord
  has_password_secure
end

D

class User < ApplicationRecord
  include HasSecurePassword
end

💡 Hint

The method name is exactly has_secure_password.

The correct syntax is to call has_secure_password inside the model class. Other options are invalid method names or modules.

❓ state_output

advanced

What is the value of user.authenticate('wrong') if the password is incorrect?

Given a User model with has_secure_password and a user with password 'secret', what does user.authenticate('wrong') return?

Ruby on Rails

user = User.new(password: 'secret', password_confirmation: 'secret')
user.save
result = user.authenticate('wrong')

A nil

B false

C true

D Raises an exception

💡 Hint

Check the documentation for authenticate return values on failure.

The authenticate method returns the user object if the password matches, otherwise it returns nil. It does not return false or raise errors.

🔧 Debug

advanced

Why does has_secure_password raise an error when the password_digest column is missing?

You added has_secure_password to your model but get an error about password_digest missing. Why?

A Because <code>has_secure_password</code> only works with <code>encrypted_password</code> column, not <code>password_digest</code>.

B Because <code>has_secure_password</code> requires a <code>password</code> column, not <code>password_digest</code>.

C Because the model must include <code>bcrypt</code> gem explicitly in the model file.

D Because <code>has_secure_password</code> requires a <code>password_digest</code> column to store the encrypted password.

💡 Hint

Think about where the encrypted password is stored in the database.

has_secure_password expects a password_digest column to save the hashed password. Without it, it cannot function and raises an error.

🧠 Conceptual

expert

How does has_secure_password improve security compared to storing plain passwords?

Why is using has_secure_password better for security than saving plain text passwords in the database?

A It encrypts passwords with a reversible cipher so admins can recover user passwords if needed.

B It hashes passwords with BCrypt, making it computationally expensive to reverse and protects against leaks.

C It stores passwords in plain text but hides them from the Rails console.

D It requires users to change passwords every day automatically.

💡 Hint

Think about what hashing means and why it is safer than plain text.

has_secure_password uses BCrypt to hash passwords. Hashing is one-way and slow, so even if the database leaks, attackers cannot easily get the original passwords.