Goal

You’ll understand the basics of has_secure_password authentication, and understand specifically what it does (and doesn’t) handle automatically, since assuming it does everything is a genuine security risk.

Learn

Rails provides has_secure_password as a built-in mechanism for basic password authentication, backed by the bcrypt gem:

class User < ApplicationRecord
  has_secure_password
end

This requires a password_digest column (not a plain password column) in the users table, and automatically provides password and password_confirmation virtual attributes, plus an authenticate method:

user = User.new(password: "secret123", password_confirmation: "secret123")
user.save

user.authenticate("secret123")   # returns the user if correct
user.authenticate("wrongpass")   # returns false if incorrect

Critically, has_secure_password automatically hashes the password using bcrypt before storing it — the actual plain-text password is never stored in the database at all, only its secure hash. This is genuinely important: even if a database were somehow compromised, the actual passwords wouldn’t be directly readable.

Here’s what has_secure_password does NOT automatically handle, which is genuinely important to know: it doesn’t manage sessions, login/logout controller logic, password reset flows, or “remember me” functionality — you still need to build those yourself, typically in a dedicated SessionsController. has_secure_password specifically handles secure password storage and verification; it’s a building block for authentication, not a complete authentication system by itself.

Decision Task

A developer adds has_secure_password to a User model and assumes login/logout functionality now works automatically. Before reading on: is this assumption correct?

Show Answer

No — has_secure_password specifically provides secure password storage (hashing) and a verification method (authenticate), but it does NOT automatically provide session management, login/logout controller actions, or any of the surrounding authentication flow. Those still need to be built explicitly, typically in a dedicated SessionsController, using authenticate as one building block within that larger flow.

Common Mistake

Assuming has_secure_password provides a complete authentication system, rather than understanding it specifically handles secure password storage and verification as one building block. Genuine authentication also requires session management and login/logout logic that has_secure_password doesn’t provide on its own — assuming otherwise can leave an application without genuinely working login functionality despite having has_secure_password correctly set up.

Practice Questions

1. What database column does has_secure_password require, and why not a plain “password” column?

Show Answer

password_digest — because the actual plain-text password should never be stored directly; only its secure bcrypt hash is stored, which is exactly what password_digest holds.

2. What does the authenticate method return if the provided password is correct?

Show Answer

The user object itself.

3. What does the authenticate method return if the provided password is incorrect?

Show Answer

false

4. True or False: has_secure_password automatically provides complete login and logout functionality.

Show Answer

False — it provides secure password storage and verification specifically; session management and login/logout logic still need to be built separately.

5. Why is storing a password’s bcrypt hash instead of the plain-text password itself genuinely important for security?

Show Answer

If the database were somehow compromised, the actual passwords wouldn’t be directly readable from the stored hash, providing a real layer of protection even in a breach scenario.

Try It Yourself

Without looking back, write the User model line that enables has_secure_password, and explain what column this specifically requires in the users table.

Show Answer

has_secure_password — this requires a password_digest column in the users table, which stores the securely hashed password rather than any plain-text version.

Quick Check

1. What does has_secure_password provide?

Show Answer

Secure password storage (hashing via bcrypt) and a verification method.

2. What database column does it require?

Show Answer

password_digest

3. What does the authenticate method return for a correct password?

Show Answer

The user object.

4. What does the authenticate method return for an incorrect password?

Show Answer

false

5. Does has_secure_password handle session management and login/logout logic automatically?

Show Answer

No — those still need to be built separately, typically in a dedicated SessionsController.