sinatra - Why is BCrypt failing to authenticate in this context? -

when create users (in sinatra), this

require 'bcrypt'  post '/users'     @user = user.new(params[:user])     @user.password_hash = bcrypt::password.create(params[:password])     p @user.password_hash == params[:password]              # prints true!     @user.save!     session[:user_id] = @user.id     redirect '/' end 

then when try verify same user this

post '/sessions'   @user = user.find_by_email(params[:email])   p @user.id                                                # prints 14   p @user.password_hash                                     # prints correct hash   p @user.password_hash.class                               # prints string   p bcrypt::password.new(@user.password_hash).class         # prints bcrypt::password    p params[:password]                                       # prints "clown123"   p bcrypt::password.new(@user.password_hash) == params[:password] # prints false!      # redirect '/' end 

what broke? example given in bcrypt docs (which doesn't use database) works every time. in db (postgres) altering password_hash?

using latest version of bcrypt, , ruby 1.9.3 (i've tried ruby 2.0 , same results)

what db column type using? try without db , use sessions instead. following worked correctly me,

# app.rb  require 'sinatra' require 'bcrypt'  enable :sessions  '/user'   session[:password_hash] = bcrypt::password.create(params[:password])   return 'success' end  '/session'   result = bcrypt::password.new(session[:password_hash]) == params[:password]   return "result: #{result}" end 

then in browser,

http://localhost:4567/user?password=secret  # => success  http://localhost:4567/session?password=secret  # => result: true  http://localhost:4567/session?password=invalid  # => result: false 

if works, try introducing db again,

require 'sinatra' require 'bcrypt'  # postgres config here...  '/pg-user'   user = user.new(password_hash: bcrypt::password.create(params[:password]))   user.save!   return 'success' end  '/pg-session'   user = user.last   result = bcrypt::password.new(user.password_hash) == params[:password]   return "result: #{result}" end