sinatra - Why is BCrypt failing to authenticate in this context? -
when create users (in sinatra), this
require 'bcrypt' post '/users' @user = user.new(params[:user]) @user.password_hash = bcrypt::password.create(params[:password]) p @user.password_hash == params[:password] # prints true! @user.save! session[:user_id] = @user.id redirect '/' end then when try verify same user this
post '/sessions' @user = user.find_by_email(params[:email]) p @user.id # prints 14 p @user.password_hash # prints correct hash p @user.password_hash.class # prints string p bcrypt::password.new(@user.password_hash).class # prints bcrypt::password p params[:password] # prints "clown123" p bcrypt::password.new(@user.password_hash) == params[:password] # prints false! # redirect '/' end what broke? example given in bcrypt docs (which doesn't use database) works every time. in db (postgres) altering password_hash?
using latest version of bcrypt, , ruby 1.9.3 (i've tried ruby 2.0 , same results)
what db column type using? try without db , use sessions instead. following worked correctly me,
# app.rb require 'sinatra' require 'bcrypt' enable :sessions '/user' session[:password_hash] = bcrypt::password.create(params[:password]) return 'success' end '/session' result = bcrypt::password.new(session[:password_hash]) == params[:password] return "result: #{result}" end then in browser,
http://localhost:4567/user?password=secret # => success http://localhost:4567/session?password=secret # => result: true http://localhost:4567/session?password=invalid # => result: false if works, try introducing db again,
require 'sinatra' require 'bcrypt' # postgres config here... '/pg-user' user = user.new(password_hash: bcrypt::password.create(params[:password])) user.save! return 'success' end '/pg-session' user = user.last result = bcrypt::password.new(user.password_hash) == params[:password] return "result: #{result}" end
Comments
Post a Comment