This guide shows how to use Bcrypt with Rails, but it differs significantly in implementation from this Rails documentation on Bcrypt.
def password=(password)
self.password_digest = BCrypt::Password.create(password)
end
def is_password?(password)
BCrypt::Password.new(self.password_digest) == password
end
But the documentation does the same thing using built in methods.
Setting user.password
or setting both user.password
and user.password_confirmation
values, then calling user.save
will invoke some callbacks from Bcrypt which will take the password values and generate the digest and save that in the database.
user.password = 'mUc3m00RsqyRe'
user.password_confirmation = 'mUc3m00RsqyRe'
user.save
The method user.authenticate(password)
will return false or the instance variable of user
depending on whether or not the password argument matches user.password_digest
.
user.authenticate('notright')
user.authenticate('mUc3m00RsqyRe')
I had always used the documentation version, since I saw it first, but does the guide follow some better practice?
Why does the guide rewrite the wheel? That seems very un-Railsy.
Is this just a difference in versions of Bcrypt or Rails?
The correct way is to use has_secure_password
(the documented method) which was available since Rails 3. Maybe the guide was based on a practice prior to Rails 3?