# Login Generator and Salter

**URL:** <https://www.ruby-forum.com/t/login-generator-and-salter/60213>\
**Category:** Rails\
**Created:** [May 11, 2006, 6:51am UTC](https://www.ruby-forum.com/t/login-generator-and-salter/60213 "2006-05-11T06:51:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohammad](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e274bd/32.png) [@mohammad](https://www.ruby-forum.com/u/mohammad)\
**Post date:** [May 11, 2006, 6:51am UTC](https://www.ruby-forum.com/t/login-generator-and-salter/60213/1 "2006-05-11T06:51:13Z")

</div>

okay, I’m using login generator. And when I log in alwase get failed. So  
I looked at my log, I gatherd infomation that says on creation the  
salted pass was: 2b8b06e5a650a4b97f146e6b5ae7ab82c43707e  
on login the salted pass is:  
2b8b06e5a650a4b97f146e6b5ae7ab82c43707e  
and in my DB it is:  
2054d52ca901ff70b5a334cb3e13d8c67940c3f3

So in my DB it change why?

---

<div class="post-metadata">

**Author:** ![mohammad](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e274bd/32.png) [@mohammad](https://www.ruby-forum.com/u/mohammad)\
**Post date:** [May 11, 2006, 4:43pm UTC](https://www.ruby-forum.com/t/login-generator-and-salter/60213/2 "2006-05-11T16:43:06Z")

</div>

Did you change your salt value in user.rb? If so, that would explain why  
the same password doesn’t hash the same way anymore.

---

<div class="post-metadata">

**Author:** ![mohammad](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e274bd/32.png) [@mohammad](https://www.ruby-forum.com/u/mohammad)\
**Post date:** [May 11, 2006, 5:45pm UTC](https://www.ruby-forum.com/t/login-generator-and-salter/60213/3 "2006-05-11T17:45:17Z")

</div>

On 5/11/06, Mohammad [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> okay, I’m using login generator. And when I log in alwase get failed. So  
> I looked at my log, I gatherd infomation that says on creation the  
> salted pass was: 2b8b06e5a650a4b97f146e6b5ae7ab82c43707e  
> on login the salted pass is:  
> 2b8b06e5a650a4b97f146e6b5ae7ab82c43707e  
> and in my DB it is:  
> 2054d52ca901ff70b5a334cb3e13d8c67940c3f3
> 
> So in my DB it change why?

While the cause of your problem could be several things, there’s one  
thing in particular you should be careful about when using the  
login\_generator’s generated user model. If you are maintaining  
additional attributes in your user model, such as for example  
some\_flag\_attrib1, some\_flag\_attrib2, and you have an action that  
updates only these attributes for some user record, be careful to do  
something like this:

@user = User.find(…)  
@user.some\_flag\_attrib1 = value1  
@user.some\_flag\_attrib2 = value2  
@user.password\_confirmation = @user.password = “”  
@user.save\_with\_validation(false)

If you don’t set password\_confirmation and password to an empty  
string, the before\_update crypt\_unless\_empty hook in the user model  
will clobber your @user’s password with a new (bogus) one (i.e., with  
the result of sha1(sha1(original\_password))). To prevent this you set  
the password\_confirmation and password to an empty string (that  
crypt\_unless\_empty does the right thing on the save), but in order to  
do this you also have to make sure that any validations that may exist  
on the password and/or password\_confirmation field do not run on your  
save (hence the save\_with\_validation(false)).

There are other ways around this, but it’s something to keep in mind.

Regards,