Hacker News Reader

Even rails doesn't ship with an auth module though. Lots of people use Devise and there is an equivalent for Elixir (Coherence)...but shipping with auth built in is an exploit waiting to happen IMO.

View on HN

Rails ships with an auth module: http://api.rubyonrails.org/classes/ActiveModel/SecurePasswor...

My mistake. :) was that added in 5?

Am I reading that right or is it just comparing an unencrypted string to the encrypted version?

It was added in 3.1 (http://guides.rubyonrails.org/3_1_release_notes.html) and uses bcrypt under the hood.

has_secure_password is not an "auth module". That's simply a handy function to handle a password attribute... which an actual auth module can make use of if it desired.

Laravel does, and their more batteries included approach is nice in my opinion

Reply on news.ycombinator.com