authenticate_by

Given a set of attributes, finds a record using the non-password attributes, and then authenticates that record using the password attributes. Returns the record if authentication succeeds; otherwise, returns nil.

Regardless of whether a record is found, authenticate_by will cryptographically digest the given password attributes. This behavior helps mitigate timing-based enumeration attacks, wherein an attacker can determine if a passworded record exists even without knowing the password.

Raises an ArgumentError if the set of attributes doesn’t contain at least one password and one non-password attribute.

Examples

class User < ActiveRecord::Base
  has_secure_password
end

User.create(name: "John Doe", email: "jdoe@example.com", password: "abc123")

User.authenticate_by(email: "jdoe@example.com", password: "abc123").name # => "John Doe" (in 373.4ms)
User.authenticate_by(email: "jdoe@example.com", password: "wrong")       # => nil (in 373.9ms)
User.authenticate_by(email: "wrong@example.com", password: "abc123")     # => nil (in 373.6ms)

User.authenticate_by(email: "jdoe@example.com", password: nil) # => nil (no queries executed)
User.authenticate_by(email: "jdoe@example.com", password: "")  # => nil (no queries executed)

User.authenticate_by(email: "jdoe@example.com") # => ArgumentError
User.authenticate_by(password: "abc123")        # => ArgumentError