2

I'm new to rails (and ruby in general), so my problem is probably easy to solve. I'm trying to create a simple app where you can create a user and log in. I'm encrypting the password with BCrypt and when i try to log in i get this error: BCrypt::Errors::InvalidSalt in SessionsController#login_attempt

Not sure what files i need to share to solve the problem, so i'll start by sharing the files where it says the error occours.

user.rb

    class User < ActiveRecord::Base
        before_save :encrypt_password
        after_save :clear_password

        attr_accessor :password
        attr_accessible :username, :email, :password, :password_confirmation

        EMAIL_REGEX = /^[A-Z0-9._%+-]+@[A-Z0-9.-]+.[A-Z]{2,4}$/i
        validates :username, :presence => true, :uniqueness => true, :length => { :in => 3..20 }
        validates :email, :presence => true, :uniqueness => true, :format => EMAIL_REGEX
        validates :password, :confirmation => true #password_confirmation attr
        validates_length_of :password, :in => 6..20, :on => :create

        def encrypt_password
            if :password.present?
                self.salt = BCrypt::Engine.generate_salt
                self.encrypted_password= BCrypt::Engine.hash_secret(:password, :salt)
            end
        end

        def clear_password
            self.password = nil
        end

        def self.authenticate(username_or_email="", login_password="")
            if  EMAIL_REGEX.match(username_or_email)    
                user = User.find_by_email(username_or_email)
            else
                user = User.find_by_username(username_or_email)
            end

            if user && user.match_password(login_password)
                return user
            else
                return false
            end
        end

        def match_password(login_password="")
            encrypted_password == BCrypt::Engine.hash_secret(login_password, salt)
        end
    end

session_controller.rb

class SessionsController < ApplicationController

  before_filter :authenticate_user, :only => [:home, :profile, :setting]
  before_filter :save_login_state, :only => [:login, :login_attempt]

  def login
    #Login Form
  end

  def login_attempt
    authorized_user = User.authenticate(params[:username_or_email],params[:login_password])
    if authorized_user
      flash[:notice] = "Wow Welcome again, you logged in as #{authorized_user.username}"
      redirect_to(:action => 'home')
    else
      flash[:notice] = "Invalid Username or Password"
      flash[:color]= "invalid"
      render "login"    
    end
  end

  def home
  end

  def profile
  end

  def setting
  end

  def logout
  session[:user_id] = nil
  redirect_to :action => 'login'
  end
end

I followed a tutorial to get this far, so if you can please explain the error too.

Thanks!

4

1 回答 1

2

没有必要在db中有一个salt字段，用加密的密码应该就足够了。如果你使用BCrypt::Password而不是BCrypt::Engine你可以将 salt 和 enc_pasword 保存在同一个字段中。尝试更改这些方法user.rb

def encrypt_password
    self.encrypted_password = BCrypt::Password.create(password) if password.present?
end

def match_password(login_password="")
    BCrypt::Password.new(password) == login_password
end
于 2013-04-25T15:21:34.710 回答