Most people used canned packages in Rails with something like Devise. Looking at the source it looks like the token is pulled right off the params: https://git

Most people used canned packages in Rails with something like Devise. Looking at the source it looks like the token is pulled right off the params: https://github.com/plataformatec/devise/blob/master/app/controllers/devise/passwords_controller.rb#L25 https://github.com/plataformatec/devise/blob/master/app/cont... The reset routine uses Rails finder mechanism to do just what the OP discusses: https://github.com/plataformatec/devise/blob/master/lib/devise/models/recoverable.rb#L124 https://github.com/plataformatec/devise/blob/master/lib/devi... I don't use MySQL because for reasons just like this - so I'm not all that surprised. That said - it would be interesting to see Devise put to the test to see if it is indeed a problem for Devise. This is not, however, a Rails issue.