# Password + salt

**URL:** <https://www.ruby-forum.com/t/password-salt/173655>\
**Category:** Rails\
**Created:** [August 12, 2009, 8:22pm UTC](https://www.ruby-forum.com/t/password-salt/173655 "2009-08-12T20:22:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![brianp](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/94ad74/32.png) [@brianp](https://www.ruby-forum.com/u/brianp)\
**Post date:** [August 12, 2009, 8:22pm UTC](https://www.ruby-forum.com/t/password-salt/173655/1 "2009-08-12T20:22:22Z")

</div>

Hey Again,

So I’m still working through AWDwR and I’ve just completed the  
authentication section for users. I understand the idea behind salts  
and general authentication. The part I feel I’m missing is when the  
first salt is created and stored to the db.  
(I can post the code but I assume anyone whos read the book knows what  
I’m referring to)

In the users\_controller I see the new user model being created, passed  
the parameters from the form and then saved. But non of the parameters  
are the salt. Nor did this function call the salt creation method in  
the user model. So I just don’t get when the salt is actually  
generated to be saved to the database.

Then to my understanding when the user logs in. The salt is pulled  
from the db concatenated onto the plain text password submitted by the  
form, SHA1 digested and compared to the hashed\_password field in the  
db. Which makes sense.

Thanks,  
-bp

---

<div class="post-metadata">

**Author:** ![brianp](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/94ad74/32.png) [@brianp](https://www.ruby-forum.com/u/brianp)\
**Post date:** [August 13, 2009, 6:35pm UTC](https://www.ruby-forum.com/t/password-salt/173655/2 "2009-08-13T18:35:54Z")

</div>

On Wed, Aug 12, 2009 at 2:06 PM, brianp[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hey Again,
> 
> So I’m still working through AWDwR and I’ve just completed the  
> authentication section for users. I understand the idea behind salts  
> and general authentication. The part I feel I’m missing is when the  
> first salt is created and stored to the db.

Assuming your are talking about the 3rd ed. It’s on pages 161-62

On p 162 is the method create\_new\_salt which computes the salt. That  
method is called in the passwd= method on p162 which calls  
create\_new\_salt and then computes the hashed password from the  
password and the salt.

HTH

## If it’s not the 3rd edition, then I’m pretty sure it’s there but just on different page numbers.

Rick DeNatale

Blog: [http://talklikeaduck.denhaven2.com/](http://talklikeaduck.denhaven2.com/)  
Twitter: [http://twitter.com/RickDeNatale](http://twitter.com/RickDeNatale)  
WWR: [http://www.workingwithrails.com/person/9021-rick-denatale](http://www.workingwithrails.com/person/9021-rick-denatale)  
LinkedIn: [http://www.linkedin.com/in/rickdenatale](http://www.linkedin.com/in/rickdenatale)