Verify current password with has_secure_password
Now with Rails 7.1, has_secure_password
can now automatically verify the current password when updating the password. This is useful to check if the user who is trying to update the password, knows the current password:
class User < ActiveRecord::Base
has_secure_password
end
user = User.new(password: "sekret", password_confirmation: "sekret")
user.save
#=> true
user.update(password: "HAHAHA", password_challenge: "")
#=> false, challenge doesn't authenticate
user.update(password: "updated*sekret", password_challenge: "sekret")
#=> true
Tweet