Devise password check

Question

I use Devise gem for authentication. How can I check if the password submitted in params array is valid?

I try to compare the value of user.encrypted_password with BCrypt::Password.create('password') but the hash values are different.

May be I need something like salt value?

Answer 1

Just use devise's valid_password? method, for example:

user.valid_password?('password123')

Answer 2

From Devise Wiki:

You can use the official solution present on the devise wiki:

user = User.find_for_authentication(email: params[:email])
user.valid_password?(params[:password])

---

Detailed answer for Rails 4+ with Strong Params