has_secure_password in Ruby on Rails - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to add password security to the User model.

Ruby on Rails

class User < ApplicationRecord
  [1]
end

Drag options to blanks, or click blank then click option'

Ahas_secure_password

Bvalidates :password

Cattr_accessor :password

Dbefore_save :encrypt_password

Attempts:

3 left

💡 Hint

Common Mistakes

Using validates :password instead of has_secure_password

Trying to manually encrypt password without has_secure_password

The has_secure_password method adds password hashing and authentication features to the model.

2fill in blank

medium

Complete the code to add a password confirmation validation in the User model.

Ruby on Rails

class User < ApplicationRecord
  has_secure_password
  validates :password, confirmation: [1]
end

Drag options to blanks, or click blank then click option'

Anil

Bfalse

Ctrue

Dpresence

Attempts:

3 left

💡 Hint

Common Mistakes

Using false disables confirmation validation

Using presence instead of a boolean

Setting confirmation: true ensures the password confirmation matches the password.

3fill in blank

hard

Fix the error in the migration to add password digest column.

Ruby on Rails

class AddPasswordDigestToUsers < ActiveRecord::Migration[6.1]
  def change
    add_column :users, :[1], :string
  end
end

Drag options to blanks, or click blank then click option'

Apassword

Bpassword_digest

Cpassword_hash

Dencrypted_password

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'password' instead of 'password_digest'

Using 'encrypted_password' which is not recognized by has_secure_password

The has_secure_password method requires a password_digest column to store the hashed password.

4fill in blank

hard

Fill both blanks to authenticate a user with email and password.

Ruby on Rails

user = User.find_by(email: [1])
if user&.[2](password)
  # login success
end

Drag options to blanks, or click blank then click option'

A:email

Bauthenticate

Cemail

Dvalid_password?

Attempts:

3 left

💡 Hint

Common Mistakes

Using :email symbol instead of the email string value

Using invalid method names like valid_password?

You find the user by their email string, then call authenticate with the password string to check credentials.

5fill in blank

hard

Fill all three blanks to create a secure password and confirm it in a new User instance.

Ruby on Rails

user = User.new(password: [1], password_confirmation: [2])
if user.[3]
  user.save
end

Drag options to blanks, or click blank then click option'

A"secret123"

Cvalid?

Dsave

Eauthenticate

Attempts:

3 left

💡 Hint

Common Mistakes

Using different strings for password and confirmation

Calling save without checking validity

Set both password and password_confirmation to the same string, then check if the user is valid before saving.

Practice

1. What does has_secure_password add to a Rails model?

easy

A. Password encryption and authentication methods

B. Automatic email validation

C. Database indexing for passwords

D. User role management

Solution

1. Step 1: Understand the purpose of has_secure_password

   This method adds password encryption and authentication features to a model.

2. Step 2: Identify what it does not add

   It does not handle email validation, indexing, or roles.

3. Final Answer:

   Password encryption and authentication methods -> Option A

4. Quick Check:

   has_secure_password = Password encryption and authentication [OK]

Hint: Remember it handles passwords securely, not emails or roles [OK]

Common Mistakes:

• Thinking it validates emails
• Assuming it manages user roles
• Believing it creates database indexes

2. Which of the following is the correct way to enable has_secure_password in a Rails model?

easy

A. Add secure_password inside the model class

B. Add has_secure_password inside the model class

C. Add password_digest method inside the model

D. Add encrypt_password in the controller

Solution

1. Step 1: Recall the syntax for enabling password security

   The correct syntax is to call has_secure_password inside the model class.

2. Step 2: Eliminate incorrect options

   The other options use wrong method names or wrong places.

3. Final Answer:

   Add has_secure_password inside the model class -> Option B

4. Quick Check:

   Enable with has_secure_password in model = Add has_secure_password inside the model class [OK]

Hint: Use exact method name inside model class [OK]

Common Mistakes:

• Using wrong method names like secure_password
• Trying to add password_digest as a method
• Placing password logic in controller

3. Given this model code:

class User < ApplicationRecord
  has_secure_password
end

And this code:

user = User.new(password: 'secret', password_confirmation: 'secret')
user.save
user.authenticate('secret')

What will user.authenticate('secret') return?

medium

A. nil

B. false

C. The user object

D. An error

Solution

1. Step 1: Understand authenticate behavior

   It returns the user object if the password matches.

2. Step 2: Check password and confirmation match

   Since password and confirmation are both 'secret', save succeeds and authenticate returns user.

3. Final Answer:

   The user object -> Option C

4. Quick Check:

   Correct password authenticates user object [OK]

Hint: authenticate returns user if password matches, else false [OK]

Common Mistakes:

• Expecting authenticate to return true/false only
• Confusing nil and false return values
• Ignoring password confirmation

4. You added has_secure_password to your model but get this error when saving: ActiveModel::MissingAttributeError: can't write unknown attribute `password_digest`. What is the likely cause?

medium

A. You did not validate password presence

B. You did not call has_secure_password in the model

C. You used password instead of password_digest in the form

D. You forgot to add the password_digest column to the database

Solution

1. Step 1: Understand the error meaning

   The error says the model cannot write to password_digest attribute because it does not exist.

2. Step 2: Identify missing database column

   has_secure_password requires a password_digest column in the database table.

3. Final Answer:

   You forgot to add the password_digest column to the database -> Option D

4. Quick Check:

   Missing password_digest column causes this error [OK]

Hint: Add password_digest column to fix this error [OK]

Common Mistakes:

• Thinking it's a missing method call
• Confusing form field names with database columns
• Assuming validation causes this error

5. You want to create a User model with secure passwords and also ensure users can only update their password if they provide the current password correctly. Which approach correctly combines has_secure_password with this logic?

hard

A. Use has_secure_password and add a custom method to verify current password before update

B. Use has_secure_password and override authenticate to check current password

C. Add password_digest column but handle password encryption manually

D. Use has_secure_password and skip password confirmation validation

Solution

1. Step 1: Understand has_secure_password role

   It provides password encryption and authentication but does not enforce current password checks on update.

2. Step 2: Implement custom logic for current password verification

   You must add a method that checks the current password before allowing password update.

3. Step 3: Evaluate options

   Use has_secure_password and add a custom method to verify current password before update correctly combines has_secure_password with custom verification. Use has_secure_password and override authenticate to check current password incorrectly suggests overriding authenticate. Add password_digest column but handle password encryption manually ignores has_secure_password benefits. Use has_secure_password and skip password confirmation validation weakens security.

4. Final Answer:

   Use has_secure_password and add a custom method to verify current password before update -> Option A

5. Quick Check:

   Combine has_secure_password with custom current password check [OK]

Hint: Add custom method to check current password before update [OK]

Common Mistakes:

• Overriding authenticate method incorrectly
• Handling encryption manually instead of using has_secure_password
• Skipping password confirmation validation