4 ms·

has_secure_password is built in, and works as long as you include the bcrypt gem in your Gemfile. I've never found Devise or any other 'off the shelf' solution

has_secure_password is built in, and works as long as you include the bcrypt gem in your Gemfile. I've never found Devise or any other 'off the shelf' solution to be satisfying for me because authentication seems to vary just enough between projects to make it easier to use has_secure_password and rewrite auth from scratch. Personally, I think it would be cool if someone built an user account/authentication experience as a generator (along the lines of Rails scaffolds), so that you could see all of the generated code and modify it without having to get elbow-deep into the bowels of what I find to be an overly-abstract gem.

ravenstine 8y ago
That's been my experience with Devise and similar libraries for other frameworks and languages. If it fulfills all needs for a project, that's great, but I tend to find that it's simpler just to build authentication around authentication "primitives" like has_secure_password. The thing I do like about Devise is that it has views for everything including password reset out of the box. The abstractions it provides end up being more of a headache than they are worth. To be honest, I'd rather see more gems for these sorts of purposes that are just a collection of off-the-shelf views that can be easily tied in to one's authentication solution of choice. By installing Devise, you bring all of the extra non-view baggage it comes with into the application's memory space even if you don't use it. Yuck. (no offense!) Actually, I just reread your comment and I think your scaffold/generator approach is also a nice way to go. It's just too bad that there hasn't been as much development effort towards these sorts of things recently in the Ruby community. I'd build it, but have gotten away from Ruby because the community is obsessed with applying object-orientation to every problem, over-abstracting, metaprogramming, etc.

ravenstine 8y ago

That's been my experience with Devise and similar libraries for other frameworks and languages. If it fulfills all needs for a project, that's great, but I tend to find that it's simpler just to build authentication around authentication "primitives" like has_secure_password. The thing I do like about Devise is that it has views for everything including password reset out of the box. The abstractions it provides end up being more of a headache than they are worth. To be honest, I'd rather see more gems for these sorts of purposes that are just a collection of off-the-shelf views that can be easily tied in to one's authentication solution of choice. By installing Devise, you bring all of the extra non-view baggage it comes with into the application's memory space even if you don't use it. Yuck. (no offense!) Actually, I just reread your comment and I think your scaffold/generator approach is also a nice way to go. It's just too bad that there hasn't been as much development effort towards these sorts of things recently in the Ruby community. I'd build it, but have gotten away from Ruby because the community is obsessed with applying object-orientation to every problem, over-abstracting, metaprogramming, etc.