# Catch authentication result from a model in a controller

**URL:** <https://www.ruby-forum.com/t/catch-authentication-result-from-a-model-in-a-controller/94120>\
**Category:** Rails\
**Created:** [April 21, 2006, 8:10pm UTC](https://www.ruby-forum.com/t/catch-authentication-result-from-a-model-in-a-controller/94120 "2006-04-21T20:10:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![anabia](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/35a633/32.png) [@anabia](https://www.ruby-forum.com/u/anabia)\
**Post date:** [April 21, 2006, 8:10pm UTC](https://www.ruby-forum.com/t/catch-authentication-result-from-a-model-in-a-controller/94120/1 "2006-04-21T20:10:27Z")

</div>

Im still following the authorization recipe from the book, now all works  
fine but im getting trouble in how handle the model authorization  
result, if the user and pass are correct, it goes to a welcome  
screen(admin.rhtml) but if wrong the model prints a message in an ugly  
exception like page “usr and pass not correct”, i want to redirect the  
user to the login screen(login\_form.rhtml) again with a message telling  
him that the auth failed, here are my code:

#model-----------------------------------------------------

require ‘digest/sha2’  
class User \< ActiveRecord::Base  
validates\_uniqueness\_of :username

def password=(pass)  
salt = [Array.new(6){rand(256).chr}.join].pack(“m”).chomp  
self.password\_salt, self.password\_hash = salt,  
Digest::SHA256.hexdigest(pass + salt)  
end

def self.authenticate(username, password)  
user = User.find(:first,  
:conditions =\> [‘username = ?’, username])  
if user.blank? ||  
Digest::SHA256.hexdigest(password + user.password\_salt) !=  
user.password\_hash  
raise “user or password wrong”  
end  
user  
end

end

#controller---------------------------------------------

class AdminController \< ApplicationController  
before\_filter :check\_authentication, :except =\> [:signin\_form, :signin]  
def index  
render “admin”

end  
def check\_authentication  
unless session[:user]  
session[:intended\_action] = action\_name  
redirect\_to :action =\> “signin\_form”  
end  
end  
def signin\_form  
render “login\_form”  
end  
def signin  
session[:user] = User.authenticate(params[:username],  
params[:password]).id  
redirect\_to :action =\> session[:signin\_form]  
end

def signout  
session[:user] = nil  
redirect\_to :action =\> “signin\_form”  
end

# …the real application’ s actions would be here.

end

that´s it, 😉

---

<div class="post-metadata">

**Author:** ![anabia](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/35a633/32.png) [@anabia](https://www.ruby-forum.com/u/anabia)\
**Post date:** [April 22, 2006, 11:09pm UTC](https://www.ruby-forum.com/t/catch-authentication-result-from-a-model-in-a-controller/94120/2 "2006-04-22T23:09:37Z")

</div>

You could do this…

def signin  
begin  
session[:user] = User.authenticate(params[:username],  
params[:password]).id  
flash[:notice] = “Logged in successfully”  
redirect\_to :action =\> session[:signin\_form]  
rescue  
flash[:warning] = ‘Login unsuccessful’  
redirect\_to :action =\> “signin\_form”  
end  
end