Ruby BCrypt密码比较返回错误的评估

Question

In order to store my user's passwords securely, I'm attempting to use BCrypt in my Sinatra/Ruby application.

The following code is of my User model.

require 'mongo_mapper'
require 'bcrypt'

# User model
class User
    include MongoMapper::Document
    include BCrypt

    key     :email,         String,         length: 6..50,      unique: true
    key     :password,      String
    key     :password_hash, String

    def password
        @password ||= Password.new(password_hash)
    end

    def password=(new_password)
        @password = Password.create(new_password)
        self.password_hash = @password
    end

    def self.authenticate(requested_email, requested_password)
        u = self.find_by_email(requested_email)
        u if u && u.password_hash == requested_password
    end
end

# Test user account
if User.count == 0
    user = User.new(email: "bar@foo.com")
    user.password = "admin"
    user.save
end

When I call the authenticate method like so: User.authenticate("bar@foo.com", "admin") , the code returns false. I am certain the user exists.

EDIT: u.password == requested_password returns false as well

Why does this happen, even when the values being passed to the method are valid and correct?

Answer 1

create a key called secret, delete password and password_hash.

Change your code to:

def password=(password)
  self.secret = BCrypt::Password.create(password)
end

def password
  return BCrypt::Password.new(secret) if self.secret
  nil
end