如何在 Rails 中为用户使用客户哈希函数？

Question

In my user model I have

create_table "users", force: :cascade do |t|
  t.string "name"
  t.string "email"
  t.datetime "created_at", precision: 6, null: false
  t.datetime "updated_at", precision: 6, null: false
  t.string "password_digest"
end

I don't understand how t.string "password_digest" work in rails? Will it use a default hash function?

Answer 1

Rails will not automatically do anything with your column just because its named password_digest . You actually have to implement password encryption for anything to happen.

Rails introduced has_secure_password in 3.1 to create a standardized way to handle password encryption and avoid the pitfalls of reinventing the password encryption wheel.

# make sure you add bcrypt to the gemfile and run bundle install
class User < ApplicationRecord
  has_secure_password
end

It adds a password= setter on the model which hashes the password with bcrypt and sets the password_digest . It also adds a password_confirmation= setter and validations.

You can then authenticate users by calling:

class SessionsController
  def create
    # will be nil or false if the email or password does not check out
    @user = User.find_by(params[:email])&.authenticate(params[:password])
    if @user
      session[:user_id] = @user.id
      redirect_to '/somewhere'
    else
      render :new, notice: 'Invalid email or password'
    end
  end
end

This compares the result of hashing params[:password] to the values stored in the database. Of course you should not really reinvent the authentication wheel if you don't want to learn more about wheels. For production apps you should really choose battle tested solutions like Devise.