# Login form

**URL:** <https://www.ruby-forum.com/t/login-form/110093>\
**Category:** Rails\
**Created:** [July 23, 2007, 12:37am UTC](https://www.ruby-forum.com/t/login-form/110093 "2007-07-23T00:37:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![xyzt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/x/839c29/32.png) [@xyzt](https://www.ruby-forum.com/u/xyzt)\
**Post date:** [July 23, 2007, 12:37am UTC](https://www.ruby-forum.com/t/login-form/110093/1 "2007-07-23T00:37:18Z")

</div>

I have a model for user and login page. When I enter right username and  
password, i can not login to the system altough the user exists in the  
db.

here’s the model:

require ‘digest/sha2’  
class User \< ActiveRecord::Base  
attr\_accessor :password

def password=(pass)  
salt = [Array.new(6){rand(256).chr}.join].pack(“m”).chomp  
self.password\_salt, self.password\_hash = salt,  
Digest::SHA256.hexdigest(pass + salt)  
end

def self.authenticate(username, password)  
user = User.find(:first, :conditions =\> [‘username = ?’, username])  
if user.blank? || Digest::SHA256.hexdigest(password +  
user.password\_salt) != user.password\_hash  
raise “Username or password invalid”  
end  
user  
end  
end

when i test the authenticate method from the console, when i type the  
right username and password it doesn’t raise error. but when i try to  
login from the login page it raise the error.

my view is:  
\<%= flash[:notice] -%\>  
\<% form\_tag :controller =\> :user, :action =\> :login do %\>

  
  
 Username   
 \<%= text\_field 'user', 'username' %\>   
  
 Password   
 \<%= password\_field 'user', 'password' %\>   
  
  
\<%= submit\_tag 'Login' -%\> \<% end %\>

and my controller is:

class UserController \< ApplicationController

def login  
if request.post?  
begin  
session[:user] =  
User.authenticate(params[:username],params[:password]).id  
redirect\_to :controller =\> session[:intended\_controller],  
:action =\> session[:intended\_action]  
rescue  
flash[:notice] = “Username or password invalid”  
end  
end  
end

def logout  
session[:user] = nil  
redirect\_to :controller =\> :user, :action =\> :index  
end

def register  
if request.post?  
@user = User.new(params[:user])  
if @user.save  
redirect\_to :action =\> :account\_creation\_success, :id =\> @user  
end  
end  
end

end

do i forget something?

---

<div class="post-metadata">

**Author:** ![xyzt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/x/839c29/32.png) [@xyzt](https://www.ruby-forum.com/u/xyzt)\
**Post date:** [July 26, 2007, 12:46am UTC](https://www.ruby-forum.com/t/login-form/110093/2 "2007-07-26T00:46:09Z")

</div>

I think the problem is in the view. Check to see of the params that  
come out of that form don’t look like 'params[:user][:username] ’ and  
’ params[:user][:password] ’

This scheme was inspired by Fowler’s Rails Recipes, right? I really  
like that basic scheme, but I’ve used a modifed version that lets you  
validate\_confirmation\_of :password almost for free. Look:

require ‘digest/sha2’  
class User \< ActiveRecord::Base

validates\_uniqueness\_of :name, :on =\> :save, :message =\> “already in  
use”  
validates\_confirmation\_of :password, :on =\> :save, :message =\> “should  
match confirmation”

before\_save :encrypt\_password

attr\_accessor :password, :password\_confirmation # virtual attributes  
needed to validate confirmation of password

def encrypt\_password

# Renamed from password=(pass). Which was causing bad behaviour when

working through associations.

# Note the change to self.password from pass in the assignment line

# call with a before\_save callback

salt= [Array.new(6) {rand(256).chr}.join].pack(“m”).chomp  
self.password\_salt, self.password\_hash = salt,  
Digest::SHA256.hexdigest(self.password+salt)  
end

def self.authenticate(username, password)  
user = User.find(:first, :conditions=\>[‘name = ?’, username])  
if user.blank?  
raise “No Such User.”  
elsif Digest::SHA256.hexdigest(password + user.password\_salt) !=  
user.password\_hash  
raise “Bad Password.”  
else  
user  
end  
end

end

---

<div class="post-metadata">

**Author:** ![xyzt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/x/839c29/32.png) [@xyzt](https://www.ruby-forum.com/u/xyzt)\
**Post date:** [July 26, 2007, 12:46am UTC](https://www.ruby-forum.com/t/login-form/110093/3 "2007-07-26T00:46:10Z")

</div>

I think the problem is in the view. Check to see of the params that  
come out of that form don’t look like 'params[:user][:username] ’ and  
’ params[:user][:password] ’

This scheme was inspired by Fowler’s Rails Recipes, right? I really  
like that basic scheme, but I’ve used a modifed version that lets you  
validate\_confirmation\_of :password almost for free. Look:

require ‘digest/sha2’  
class User \< ActiveRecord::Base

validates\_uniqueness\_of :name, :on =\> :save, :message =\> “already in  
use”  
validates\_confirmation\_of :password, :on =\> :save, :message =\> “should  
match confirmation”

before\_save :encrypt\_password

attr\_accessor :password, :password\_confirmation # virtual attributes  
needed to validate confirmation of password

def encrypt\_password

# Renamed from password=(pass). Which was causing bad behaviour when

working through associations.

# Note the change to self.password from pass in the assignment line

# call with a before\_save callback

salt= [Array.new(6) {rand(256).chr}.join].pack(“m”).chomp  
self.password\_salt, self.password\_hash = salt,  
Digest::SHA256.hexdigest(self.password+salt)  
end

def self.authenticate(username, password)  
user = User.find(:first, :conditions=\>[‘name = ?’, username])  
if user.blank?  
raise “No Such User.”  
elsif Digest::SHA256.hexdigest(password + user.password\_salt) !=  
user.password\_hash  
raise “Bad Password.”  
else  
user  
end  
end

end

---

<div class="post-metadata">

**Author:** ![xyzt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/x/839c29/32.png) [@xyzt](https://www.ruby-forum.com/u/xyzt)\
**Post date:** [July 26, 2007, 12:46am UTC](https://www.ruby-forum.com/t/login-form/110093/4 "2007-07-26T00:46:17Z")

</div>

Oops!

that callback should be before\_create not before save.