我如何有时需要密码而有时不需要 has_secure_password? [英] How can I sometimes require password and sometimes not with has_secure_password?

问题描述

我的应用允许人们使用密码或通过 Facebook 进行注册.

My app lets people register using a password OR with Facebook.

即使我从我的用户模型中删除密码验证，我也会得到 :password_digest =>[不能为空"] 在用户模型上.

Even when I remove the password validations from my User model, I get :password_digest => ["can't be blank"] on the user model.

我使用has_secure_password.

如何使 password_digest 不需要?

推荐答案

你不能.has_secure_password向您的模型添加两个验证器:

You can't. has_secure_password automatically adds two validators to your model:

validates_confirmation_of :password
validates_presence_of     :password_digest

相反，为没有密码的用户提供 password_digest 的虚拟值:

Instead, supply a dummy value for password_digest for users that don't have a password:

user.password = user.password_confirmation = ""
user.password_digest = "facebook-authorized account"

这是安全的，因为不可能对密码进行哈希处理以匹配该摘要.

This is secure, as no password can possibly be hashed to match that digest.

这篇关于我如何有时需要密码而有时不需要 has_secure_password?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！