has_secure_password in Ruby on Rails - Mini Project: Build & Apply

Using has_secure_password in Rails

📖 Scenario: You are building a simple user authentication system for a website. Users will have a password that needs to be stored securely.

🎯 Goal: Create a Rails model that uses has_secure_password to handle password hashing and authentication.

📋 What You'll Learn

Create a User model with a password digest column

Add has_secure_password to the User model

Create a new User instance with a password

Verify that the password is stored securely and authentication works

💡 Why This Matters

🌍 Real World

Web applications need to store user passwords securely to protect user accounts and data.

💼 Career

Understanding has_secure_password is essential for Rails developers building authentication systems.

1

Create User model with password_digest column

Create a Rails model called User with a string column named password_digest in the database migration.

Ruby on Rails

# Create User model and migration with password_digest column
# Your code here

Hint

Use rails generate model User password_digest:string to create the model and migration.

2

Add has_secure_password to User model

Add has_secure_password inside the User model class to enable password hashing and authentication.

Ruby on Rails

class User < ApplicationRecord
  # Add has_secure_password here
  # Your code here
end

# Migration file example:
# class CreateUsers < ActiveRecord::Migration[7.0]
#   def change
#     create_table :users do |t|
#       t.string :password_digest
#       t.timestamps
#     end
#   end
# end

Hint

Place has_secure_password inside the User class, below class User < ApplicationRecord.

3

Create a new User with a password

Write code to create a new User instance with password set to "secret123" and save it to the database.

Ruby on Rails

class User < ApplicationRecord
  has_secure_password
end

# Create a new user with password 'secret123'
# Your code here

Hint

Use User.new(password: "secret123") to create the user and then call save on it.

4

Authenticate the User with password

Use the authenticate method on the user object to check if the password "secret123" is correct.

Ruby on Rails

class User < ApplicationRecord
  has_secure_password
end

user = User.new(password: "secret123")
user.save

# Authenticate user with password 'secret123'
# Your code here

Hint

Call user.authenticate("secret123") to verify the password.

Practice

1. What does has_secure_password add to a Rails model?

easy

A. Password encryption and authentication methods

B. Automatic email validation

C. Database indexing for passwords

D. User role management

Solution

1. Step 1: Understand the purpose of has_secure_password

   This method adds password encryption and authentication features to a model.

2. Step 2: Identify what it does not add

   It does not handle email validation, indexing, or roles.

3. Final Answer:

   Password encryption and authentication methods -> Option A

4. Quick Check:

   has_secure_password = Password encryption and authentication [OK]

Hint: Remember it handles passwords securely, not emails or roles [OK]

Common Mistakes:

• Thinking it validates emails
• Assuming it manages user roles
• Believing it creates database indexes

2. Which of the following is the correct way to enable has_secure_password in a Rails model?

easy

A. Add secure_password inside the model class

B. Add has_secure_password inside the model class

C. Add password_digest method inside the model

D. Add encrypt_password in the controller

Solution

1. Step 1: Recall the syntax for enabling password security

   The correct syntax is to call has_secure_password inside the model class.

2. Step 2: Eliminate incorrect options

   The other options use wrong method names or wrong places.

3. Final Answer:

   Add has_secure_password inside the model class -> Option B

4. Quick Check:

   Enable with has_secure_password in model = Add has_secure_password inside the model class [OK]

Hint: Use exact method name inside model class [OK]

Common Mistakes:

• Using wrong method names like secure_password
• Trying to add password_digest as a method
• Placing password logic in controller

3. Given this model code:

class User < ApplicationRecord
  has_secure_password
end

And this code:

user = User.new(password: 'secret', password_confirmation: 'secret')
user.save
user.authenticate('secret')

What will user.authenticate('secret') return?

medium

A. nil

B. false

C. The user object

D. An error

Solution

1. Step 1: Understand authenticate behavior

   It returns the user object if the password matches.

2. Step 2: Check password and confirmation match

   Since password and confirmation are both 'secret', save succeeds and authenticate returns user.

3. Final Answer:

   The user object -> Option C

4. Quick Check:

   Correct password authenticates user object [OK]

Hint: authenticate returns user if password matches, else false [OK]

Common Mistakes:

• Expecting authenticate to return true/false only
• Confusing nil and false return values
• Ignoring password confirmation

4. You added has_secure_password to your model but get this error when saving: ActiveModel::MissingAttributeError: can't write unknown attribute `password_digest`. What is the likely cause?

medium

A. You did not validate password presence

B. You did not call has_secure_password in the model

C. You used password instead of password_digest in the form

D. You forgot to add the password_digest column to the database

Solution

1. Step 1: Understand the error meaning

   The error says the model cannot write to password_digest attribute because it does not exist.

2. Step 2: Identify missing database column

   has_secure_password requires a password_digest column in the database table.

3. Final Answer:

   You forgot to add the password_digest column to the database -> Option D

4. Quick Check:

   Missing password_digest column causes this error [OK]

Hint: Add password_digest column to fix this error [OK]

Common Mistakes:

• Thinking it's a missing method call
• Confusing form field names with database columns
• Assuming validation causes this error

5. You want to create a User model with secure passwords and also ensure users can only update their password if they provide the current password correctly. Which approach correctly combines has_secure_password with this logic?

hard

A. Use has_secure_password and add a custom method to verify current password before update

B. Use has_secure_password and override authenticate to check current password

C. Add password_digest column but handle password encryption manually

D. Use has_secure_password and skip password confirmation validation

Solution

1. Step 1: Understand has_secure_password role

   It provides password encryption and authentication but does not enforce current password checks on update.

2. Step 2: Implement custom logic for current password verification

   You must add a method that checks the current password before allowing password update.

3. Step 3: Evaluate options

   Use has_secure_password and add a custom method to verify current password before update correctly combines has_secure_password with custom verification. Use has_secure_password and override authenticate to check current password incorrectly suggests overriding authenticate. Add password_digest column but handle password encryption manually ignores has_secure_password benefits. Use has_secure_password and skip password confirmation validation weakens security.

4. Final Answer:

   Use has_secure_password and add a custom method to verify current password before update -> Option A

5. Quick Check:

   Combine has_secure_password with custom current password check [OK]

Hint: Add custom method to check current password before update [OK]

Common Mistakes:

• Overriding authenticate method incorrectly
• Handling encryption manually instead of using has_secure_password
• Skipping password confirmation validation