# Mailing encrypted password to user **URL:** \ **Category:** Rails\ **Created:** [December 19, 2007, 12:23pm UTC](https://www.ruby-forum.com/t/mailing-encrypted-password-to-user/123641 "2007-12-19T12:23:16Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![vapor](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/5e9695/32.png) [@vapor](https://www.ruby-forum.com/u/vapor)\ **Post date:** [December 19, 2007, 12:23pm UTC](https://www.ruby-forum.com/t/mailing-encrypted-password-to-user/123641/1 "2007-12-19T12:23:16Z")
How can I email password to user that is stored in SHA1 encrypted format? Thanks ---
**Author:** ![vapor](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/5e9695/32.png) [@vapor](https://www.ruby-forum.com/u/vapor)\ **Post date:** [December 19, 2007, 12:30pm UTC](https://www.ruby-forum.com/t/mailing-encrypted-password-to-user/123641/2 "2007-12-19T12:30:08Z")
as far as i know, you can’t decrypt it, so what we do, is to send him a new one, we randomly generate ---
**Author:** ![vapor](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/5e9695/32.png) [@vapor](https://www.ruby-forum.com/u/vapor)\ **Post date:** [December 19, 2007, 12:31pm UTC](https://www.ruby-forum.com/t/mailing-encrypted-password-to-user/123641/3 "2007-12-19T12:31:59Z")
Presumably this is to allow a user access to an account after they’ve forgotten their password. It would be much safer to generate a new random password for them and send that to the email address you have on file, not one they specify when the password is requested. You could also disable the account until they click a confirmation link in an email. Gareth * * * Gareth Howells, CertHE (Dunelm), BCS CEO, GForce Industries removed\_email\_address@domain.invalid 07862725134 GForce Industries 86, Warwick Avenue, Quorn, Loughborough, LEICS. LE12 8HE ----- Original Message ----- From: “Vapor …” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) To: [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) Sent: Wednesday, December 19, 2007 11:23 AM Subject: [Rails] Mailing encrypted password to user ---
**Author:** ![vapor](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/5e9695/32.png) [@vapor](https://www.ruby-forum.com/u/vapor)\ **Post date:** [December 19, 2007, 12:58pm UTC](https://www.ruby-forum.com/t/mailing-encrypted-password-to-user/123641/4 "2007-12-19T12:58:25Z")
On 19 Dec 2007, at 11:23, Vapor … wrote: > How can I email password to user that is stored in SHA1 encrypted > format? > Thanks > SHA1 isn’t an encryption method. it’s a one-way hash. Fred ---
**Author:** ![vapor](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/5e9695/32.png) [@vapor](https://www.ruby-forum.com/u/vapor)\ **Post date:** [December 19, 2007, 1:00pm UTC](https://www.ruby-forum.com/t/mailing-encrypted-password-to-user/123641/5 "2007-12-19T13:00:46Z")
On 12/19/07, Vapor … [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > Gareth > > But in this scenario, I can reset anybody’s password and disable account > just by giving his email address. And the target will have to activate > everytime. Create a random token and mail them a link containing that. Only when they use that link you let them specify a new password or create one for them. Sincerely, Isak ---
**Author:** ![vapor](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/5e9695/32.png) [@vapor](https://www.ruby-forum.com/u/vapor)\ **Post date:** [December 19, 2007, 1:14pm UTC](https://www.ruby-forum.com/t/mailing-encrypted-password-to-user/123641/6 "2007-12-19T13:14:57Z")
> Create a random token and mail them a link containing that. Only when > they use that link you let them specify a new password or create one > for them. I need a little help with this…suppose I send user this link with token at the end … /user/reset\_password/abc123 \<- abc123 is random token…it is going to tell me something like template missing and stuff…how to deal with that? ---
**Author:** ![vapor](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/5e9695/32.png) [@vapor](https://www.ruby-forum.com/u/vapor)\ **Post date:** [December 19, 2007, 9:22pm UTC](https://www.ruby-forum.com/t/mailing-encrypted-password-to-user/123641/7 "2007-12-19T21:22:12Z")
On 12/19/07, Vapor … [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > Create a random token and mail them a link containing that. Only when > > they use that link you let them specify a new password or create one > > for them. > > I need a little help with this…suppose I send user this link with > token at the end … /user/reset\_password/abc123 ← abc123 is random > token…it is going to tell me something like template missing and > stuff…how to deal with that? If you’ve left the default route along in config/routes.rb That url should get mapped to :controller =\> UsersController, :action =\> :reset\_password, :id =\> “abc123” So in your reset\_password method you refer to the code as params[:id] If you want to you can create an explicit named route with: map.reset\_password ‘/user/reset\_password/:activation\_code’, :controller =\> ‘user’, :action =\> ‘reset\_password’ – Rick DeNatale My blog on Ruby [http://talklikeaduck.denhaven2.com/](http://talklikeaduck.denhaven2.com/) ---
**Author:** ![vapor](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/5e9695/32.png) [@vapor](https://www.ruby-forum.com/u/vapor)\ **Post date:** [December 19, 2007, 12:51pm UTC](https://www.ruby-forum.com/t/mailing-encrypted-password-to-user/123641/8 "2007-12-19T12:51:21Z")
Gareth Howells wrote: > Presumably this is to allow a user access to an account after they’ve > forgotten their password. It would be much safer to generate a new > random > password for them and send that to the email address you have on file, > not > one they specify when the password is requested. You could also disable > the > account until they click a confirmation link in an email. > > Gareth But in this scenario, I can reset anybody’s password and disable account just by giving his email address. And the target will have to activate everytime. ---
**Author:** ![vapor](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/5e9695/32.png) [@vapor](https://www.ruby-forum.com/u/vapor)\ **Post date:** [December 20, 2007, 8:09am UTC](https://www.ruby-forum.com/t/mailing-encrypted-password-to-user/123641/9 "2007-12-20T08:09:10Z")
Rick Denatale wrote: > If you’ve left the default route along in config/routes.rb That url > should get mapped to > > :controller =\> UsersController, :action =\> :reset\_password, :id =\> > “abc123” > > So in your reset\_password method you refer to the code as params[:id] > > If you want to you can create an explicit named route with: > > map.reset\_password ‘/user/reset\_password/:activation\_code’, > :controller =\> ‘user’, :action =\> ‘reset\_password’ Thanks 🙂