Disable the has_secure_password password_confirmation check in Rails 4

Question

I'm creating a basic Ruby on Rails 4 project that allows user to create accounts, login, etc... I'm using the built in has_secure_password to manage the password. I don't want users to have to enter their password twice (i.e. require a password_confirmation input form field and corresponding model attribute). So, I'm looking for a way to turn the password_confirmation check/requirement off.

I found this answer that provides a potential solution, but the original question is different enough that I want to verify it separately. It recommends updating the user model to add the following:

class User < ActiveRecord::Base

  # ...

  has_secure_password validations: false
  validates :password, presence: true, length: { minimum: 6 }

end

This seems to work and allows my RSpec tests to pass. My two part question is:

Are there any negative consequences or security problems with this approach?
Are there alternate ways to turn off password_confirmation that are safer or more inline with "The Ruby Way"?

kequc · Accepted Answer · 2014-01-15 18:40:24Z

13

ActiveModel::SecurePassword has an options parameter to which you can specify not to perform validations.

has_secure_password validations: false

Then just make sure you perform a validation on your password field manually.

validates_presence_of :password, on: :create

Optionally the only other thing missing is to raise an error if the password_digest is somehow blank. I don't know how that could happen.

before_create { raise "Password digest missing on new record" if password_digest.blank? }

This seems to me resolves the issue as cleanly as possible.

edited Jan 15, 2014 at 18:40

answered Jan 15, 2014 at 18:34

kequc

4776 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Violet Shreve · Accepted Answer · 2013-11-01 18:47:39Z

4

If you'll take a look at ActiveModel::SecurePassword, you'll see the validations created by has_secure_password.

if options.fetch(:validations, true)
      validates_confirmation_of :password, if: :should_confirm_password?
      validates_presence_of     :password, on: :create
      validates_presence_of     :password_confirmation, if: :should_confirm_password?

      before_create { raise "Password digest missing on new record" if password_digest.blank? }
end

by disabling validations, you're also preventing the check for the field :password_digest, which isn't a huge deal but still not ideal.

I think the better option is to override the default method, should_confirm_password?

# If password_confirmation is passed, business as usual.
# If not, don't run the validations
def should_confirm_password?
    password_confirmation.present? || false
end

edited Nov 1, 2013 at 18:47

answered Nov 1, 2013 at 18:13

Violet Shreve

1,1387 silver badges18 bronze badges

1 Comment

Pants Over a year ago

I don't think this is accurate in Rails 6 anymore. The approved answer is the better one.

Pants · Accepted Answer · 2019-10-14 11:48:48Z

0

For Rails 6, AFAICT (didn't check other versions), you simply don't pass a password_confirmation attribute to your model. It is not required by default.

See https://github.com/rails/rails/blob/master/activemodel/lib/active_model/validations/confirmation.rb#L75

answered Oct 14, 2019 at 11:48

Pants

2,8421 gold badge24 silver badges35 bronze badges

Collectives™ on Stack Overflow

Disable the has_secure_password password_confirmation check in Rails 4

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related