has_secure_password in Ruby on Rails - Step-by-Step Execution

Concept Flow - has_secure_password

Model includes has_secure_password

↓

Adds password and password_confirmation virtual attributes

↓

On save: password is hashed with bcrypt

↓

Stores hashed password in password_digest column

↓

Authenticate method checks password against digest

↓

Returns user if password matches, else false

This flow shows how has_secure_password adds password handling to a model, hashes the password, stores it securely, and authenticates users.

Execution Sample

Ruby on Rails

class User < ApplicationRecord
  has_secure_password
end

user = User.new(password: "secret", password_confirmation: "secret")
user.save
user.authenticate("secret")

This code creates a User with a password, saves it securely, and authenticates the password.

Execution Table

Step	Action	Input/Condition	Result	Notes
1	Create User instance	password: 'secret', password_confirmation: 'secret'	User object with virtual password attributes	password_digest is nil initially
2	Call save	password and confirmation match	Password hashed and stored in password_digest	bcrypt hashes password securely
3	Call authenticate('secret')	Password matches digest	Returns User object	Authentication successful
4	Call authenticate('wrong')	Password does not match digest	Returns false	Authentication failed

💡 Authentication returns false when password does not match stored digest

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4
user.password	nil	"secret"	nil	nil	nil
user.password_confirmation	nil	"secret"	nil	nil	nil
user.password_digest	nil	nil	"$2a$...hashed..."	"$2a$...hashed..."	"$2a$...hashed..."
authenticate result	n/a	n/a	n/a	User object	false

Key Moments - 3 Insights

Why don't we see the plain password saved in the database?

Because has_secure_password stores only the hashed password in password_digest, not the plain password. See execution_table step 2 where password_digest is set after hashing.

What happens if password and password_confirmation do not match?

The save will fail because has_secure_password validates that password and confirmation match before hashing. This is implied in execution_table step 2 condition.

What does authenticate return if the password is wrong?

It returns false, as shown in execution_table step 4, indicating authentication failure.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of user.password_digest after saving the user?

A A hashed string starting with $2a$

B The plain text password 'secret'

C nil

D The password_confirmation value

💡 Hint

Check execution_table row 2 under Result column

At which step does authenticate return false?

A Step 1

B Step 3

C Step 4

D Step 2

💡 Hint

Look at execution_table rows 3 and 4 for authenticate results

If password_confirmation did not match password, what would happen during save?

A User saves successfully with hashed password

B Save fails due to validation error

C Password_digest is set to nil

D Authenticate returns true anyway

💡 Hint

Refer to key_moments about password confirmation validation

Concept Snapshot

has_secure_password adds password handling to Rails models.
It creates virtual password and confirmation attributes.
On save, it hashes the password with bcrypt into password_digest.
Authenticate checks password against the digest.
Returns user if correct, false if not.
Requires password_digest column in database.

Full Transcript

The has_secure_password method in Rails adds secure password handling to a model. When you add it, the model gets virtual attributes for password and password_confirmation. When you save the model, it hashes the password using bcrypt and stores the hash in the password_digest column. The plain password is never saved. You can then call authenticate with a password string. If it matches the stored hash, authenticate returns the user object. If not, it returns false. This helps keep passwords safe and easy to check. The password and confirmation must match to save successfully.