# Question about Salted Hash Login Generator **URL:** \ **Category:** Rails\ **Created:** [July 4, 2006, 10:20am UTC](https://www.ruby-forum.com/t/question-about-salted-hash-login-generator/97025 "2006-07-04T10:20:19Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![arnoldng](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/839c29/32.png) [@arnoldng](https://www.ruby-forum.com/u/arnoldng)\ **Post date:** [July 4, 2006, 10:20am UTC](https://www.ruby-forum.com/t/question-about-salted-hash-login-generator/97025/1 "2006-07-04T10:20:19Z")
Hi, I am using salted hash login generator to create my login page. In the user\_environment.rb file, I saw that there is a comment saying should NOT include the email field in the changeable user fields array. Does anyone know why? > # Add all changeable user fields to this array. > > # They will then be able to be edited from the edit action. You > > # should NOT include the email field in this array. I would like to make the email field to be updateable and use email to logon. Thanks. Arnold. ---
**Author:** ![arnoldng](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/839c29/32.png) [@arnoldng](https://www.ruby-forum.com/u/arnoldng)\ **Post date:** [July 4, 2006, 12:41pm UTC](https://www.ruby-forum.com/t/question-about-salted-hash-login-generator/97025/2 "2006-07-04T12:41:14Z")
Arnold Ng wrote: > Hi, > > I am using salted hash login generator to create my login page. In the > user\_environment.rb file, I saw that there is a comment saying should > NOT include the email field in the changeable user fields array. Does > anyone know why? > > > # Add all changeable user fields to this array. > > > > # They will then be able to be edited from the edit action. You > > > > # should NOT include the email field in this array. > > I would like to make the email field to be updateable and use email to > logon. > Thanks. > > Arnold. I would strongly advise you not to use salted hash login generator. It’s a real pain, with all it’s excessive syntactic sugar and localisation stuff. Acts\_as authenticated is much cleaner, and there are several big acl/rbac things you can run on top of it - check out the rails wiki. I’m in the middle of cleaning all the s-h-l-g stuff out of my application. To answer your question, I think that allowing a use to change their email address would mean that they could put something invalid in it. If they then forget their password, they’re stuffed! Robert J. ---
**Author:** ![arnoldng](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/839c29/32.png) [@arnoldng](https://www.ruby-forum.com/u/arnoldng)\ **Post date:** [July 4, 2006, 7:12pm UTC](https://www.ruby-forum.com/t/question-about-salted-hash-login-generator/97025/3 "2006-07-04T19:12:28Z")
Robert J. wrote: > If they then forget their password, they’re stuffed! > > Robert J. Hi Robert, The Agile Web D. book explains how to set up a salted hash password scheme for user access. It seemed like a simple and elegant enough solution for basic access control management. The main restriction (imho) was that a user cannot request his/ her password to be mailed to him/ her - the password must always be reset to a new password. Other than that, what would be your reason to move away from it? To be honest, I haven’t used the s-h-l-g itself, so I don’t know what else it brings to the party. Also, I haven’t had the time to look at acts\_as\_authenticated, but plan to do so soon… Cheers Mohit. ---
**Author:** ![arnoldng](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/839c29/32.png) [@arnoldng](https://www.ruby-forum.com/u/arnoldng)\ **Post date:** [July 4, 2006, 8:47pm UTC](https://www.ruby-forum.com/t/question-about-salted-hash-login-generator/97025/4 "2006-07-04T20:47:41Z")
Mohit S. wrote: > Robert J. wrote: > > > If they then forget their password, they’re stuffed! > > > > Robert J. > > Hi Robert, > > The Agile Web D. book explains how to set up a salted hash > password scheme for user access. It seemed like a simple and elegant > enough solution for basic access control management. The main > restriction (imho) was that a user cannot request his/ her password to > be mailed to him/ her - the password must always be reset to a new > password. > > Other than that, what would be your reason to move away from it? To be > honest, I haven’t used the s-h-l-g itself, so I don’t know what else it > brings to the party. Also, I haven’t had the time to look at > acts\_as\_authenticated, but plan to do so soon… > > Cheers > Mohi What else it brings to the party is a load of (IMHO) pretty pointless helper functions that make the .rhtml files hard to read and localisation stuff that most people aren’t going to use. Don’t get me wrong - I’m very grateful that shlg existed, but I think acts\_as authenticated is a nicer solution which builds on the great work that Tobias L. did initially. Essentially acts\_as authenticated is a stripped down version of shlg [no doubt someone will put me right otherwise!]. Cheers, Robert ---
**Author:** ![arnoldng](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/839c29/32.png) [@arnoldng](https://www.ruby-forum.com/u/arnoldng)\ **Post date:** [July 4, 2006, 10:21pm UTC](https://www.ruby-forum.com/t/question-about-salted-hash-login-generator/97025/5 "2006-07-04T22:21:32Z")
On Tue, Jul 04, 2006, Robert J. wrote: > What else it brings to the party is a load of (IMHO) pretty pointless > helper functions that make the .rhtml files hard to read and > localisation stuff that most people aren’t going to use. Don’t get me > wrong - I’m very grateful that shlg existed, but I think acts\_as > authenticated is a nicer solution which builds on the great work that > Tobias L. did initially. Essentially acts\_as authenticated is a > stripped down version of shlg [no doubt someone will put me right > otherwise!]. You’re exactly right. The Login Generator came first and was pretty decent, then the SHLG, which was a good idea but the execution was lacking. Aside from the localization stuff that you mentioned (who knows who thought it would be a good idea to make _that_ mandatory!) there were problems with the tests and other things. Then came acts\_as\_authenticated, and for the most part everyone converted and never looked back. The SHLG has some merits and is worth a look for learning purposes, but it’s also pretty old (I believe I used it in 0.12 days?) and I don’t think it’s being updated anymore. Ben