Learn Rails 8 by Building Study Flow, Part 2: Authentication with the Built-in Generator
In Part 1 we generated a Rails 8 app and followed a request from route to controller. Today Study Flow gets its first real feature: users . Before this Rails version, most people added a gem like Devise to get login. Rails 8 ships its own authentication generator . It writes plain Ruby code into your app, so you can read all of it, and that's exactly what we'll do. What you'll learn Running the…
In the second part of our Rails 8 authentication tutorial, we dive into building a study flow feature that includes user authentication. Unlike previous versions, Rails 8 now comes with its own authentication generator, which we'll explore in detail.
We begin by running the generator with the command `bin/rails generate authentication`, followed by migrating the database using `bin/rails db:migrate`. It's essential to ensure that the `bcrypt` gem is enabled in your Gemfile, as the generator will uncomment it and require a bundle install using `gem 'bcrypt', '~> 3.1.7'`.
After running the generator, several files are created, including `app/models/user.rb`, `app/models/session.rb`, `app/models/current.rb`, `app/controllers/concerns/authentication.rb`, `app/controllers/sessions_controller.rb`, `app/controllers/passwords_controller.rb`, `app/mailers/passwords_mailer.rb`, and various view files. We'll focus on the most important aspects of these files.
The `db/migrate` folder contains two new migration files: `..._create_users.rb` and `..._create_sessions.rb`. The `users` table stores `email_address` and `password_digest`, along with timestamps. The `password_digest` field is a one-way hash of the user's password, ensuring sensitive information is never stored in plaintext. The `sessions` table records each login attempt, including the user's IP address and browser user agent.
In the `User` model, we find two crucial lines: `has_secure_password` and `has_many :sessions, dependent: :destroy`. The `has_secure_password` method adds attributes for the password and its confirmation, hashes the password using bcrypt, and provides methods for password authentication. The `has_many :sessions, dependent: :destroy` association ensures that when a user is deleted, their associated sessions are also removed.
The `Current` module serves as a request-wide global variable, allowing controllers, views, and models to access the current session for the duration of a single request. This is achieved by defining an `attribute` called `session` and delegating to the `session` object. This module is particularly useful for checking if a user is logged in, as it provides access to `Current.session` and `Current.user` without passing them around explicitly.
Finally, the `Authentication` concern is introduced, which serves as the heart of the authentication system. It includes methods such as `require_authentication` and `authenticated?`, which help ensure that only authenticated users can access protected routes. The `allow_unauthenticated_access` method allows specific actions to bypass the authentication check when necessary.
By following this guide, you'll have a solid understanding of how to implement authentication in a Rails 8 application using the built-in generator. Remember, the key to a successful implementation lies in understanding the underlying concepts, such as session management, password hashing, and the role of the `Current` module in managing request-wide data.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
