Module: Devise::Models::DatabaseAuthenticatable

Extended by:
ActiveSupport::Concern
Defined in:
lib/devise/models/database_authenticatable.rb

Overview

Authenticable Module, responsible for encrypting password and validating authenticity of a user while signing in.

Configuration:

You can overwrite configuration values by setting in globally in Devise, using devise method or overwriting the respective instance method.

pepper: encryption key used for creating encrypted password. Each time
        password changes, it's gonna be encrypted again, and this key
        is added to the password and salt to create a secure hash.
        Always use `rake secret' to generate a new key.

stretches: defines how many times the password will be encrypted.

encryptor: the encryptor going to be used. By default :sha1.

Examples:

User.find(1).valid_password?('password123')         # returns true/false

Defined Under Namespace

Modules: ClassMethods

Instance Method Summary collapse

Instance Method Details

#after_database_authentication ⇒ Object 



78
79
 
# File 'lib/devise/models/database_authenticatable.rb', line 78

def after_database_authentication
end

#clean_up_passwords ⇒ Object

Set password and password confirmation to nil



51
52
53
 
# File 'lib/devise/models/database_authenticatable.rb', line 51

def clean_up_passwords
  self.password = self.password_confirmation = nil
end

#password=(new_password) ⇒ Object

Regenerates password salt and encrypted password each time password is set, and then trigger any “after_changed_password”-callbacks.



36
37
38
39
40
41
42
43
 
# File 'lib/devise/models/database_authenticatable.rb', line 36

def password=(new_password)
  @password = new_password

  if @password.present?
    self.password_salt = self.class.password_salt
    self.encrypted_password = password_digest(@password)
  end
end

#update_with_password(params = {}) ⇒ Object

Update record attributes when :current_password matches, otherwise returns error on :current_password. It also automatically rejects :password and :password_confirmation if they are blank.



58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
 
# File 'lib/devise/models/database_authenticatable.rb', line 58

def update_with_password(params={})
  current_password = params.delete(:current_password)

  if params[:password].blank?
    params.delete(:password)
    params.delete(:password_confirmation) if params[:password_confirmation].blank?
  end

  result = if valid_password?(current_password)
    update_attributes(params)
  else
    self.errors.add(:current_password, current_password.blank? ? :blank : :invalid)
    self.attributes = params
    false
  end

  clean_up_passwords
  result
end

#valid_password?(incoming_password) ⇒ Boolean

Verifies whether an incoming_password (ie from sign in) is the user password.

Returns:

  • (Boolean) 


46
47
48
 
# File 'lib/devise/models/database_authenticatable.rb', line 46

def valid_password?(incoming_password)
  password_digest(incoming_password) == self.encrypted_password
end