{
  "id": 19349559,
  "title": "Learn Rails 8 by Building Study Flow, Part 2: Authentication with the Built-in Generator",
  "url": "https://urgent.news/2026/11/10/learn-rails-8-by-building-study-flow-part-2-authentication-with-the",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-10T15:01:00.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/shroukabozeid/learn-rails-8-by-building-study-flow-part-2-authentication-with-the-built-in-generator-18hi"
  },
  "original_language": "en",
  "account": "In the second part of our Rails 8 authentication tutorial, we dive into building a study flow feature that includes user authentication. Unlike previous versions, Rails 8 now comes with its own authentication generator, which we'll explore in detail.\n\nWe begin by running the generator with the command `bin/rails generate authentication`, followed by migrating the database using `bin/rails db:migrate`. It's essential to ensure that the `bcrypt` gem is enabled in your Gemfile, as the generator will uncomment it and require a bundle install using `gem 'bcrypt', '~> 3.1.7'`.\n\nAfter running the generator, several files are created, including `app/models/user.rb`, `app/models/session.rb`, `app/models/current.rb`, `app/controllers/concerns/authentication.rb`, `app/controllers/sessions_controller.rb`, `app/controllers/passwords_controller.rb`, `app/mailers/passwords_mailer.rb`, and various view files. We'll focus on the most important aspects of these files.\n\nThe `db/migrate` folder contains two new migration files: `..._create_users.rb` and `..._create_sessions.rb`. The `users` table stores `email_address` and `password_digest`, along with timestamps. The `password_digest` field is a one-way hash of the user's password, ensuring sensitive information is never stored in plaintext. The `sessions` table records each login attempt, including the user's IP address and browser user agent.\n\nIn the `User` model, we find two crucial lines: `has_secure_password` and `has_many :sessions, dependent: :destroy`. The `has_secure_password` method adds attributes for the password and its confirmation, hashes the password using bcrypt, and provides methods for password authentication. The `has_many :sessions, dependent: :destroy` association ensures that when a user is deleted, their associated sessions are also removed.\n\nThe `Current` module serves as a request-wide global variable, allowing controllers, views, and models to access the current session for the duration of a single request. This is achieved by defining an `attribute` called `session` and delegating to the `session` object. This module is particularly useful for checking if a user is logged in, as it provides access to `Current.session` and `Current.user` without passing them around explicitly.\n\nFinally, the `Authentication` concern is introduced, which serves as the heart of the authentication system. It includes methods such as `require_authentication` and `authenticated?`, which help ensure that only authenticated users can access protected routes. The `allow_unauthenticated_access` method allows specific actions to bypass the authentication check when necessary.\n\nBy following this guide, you'll have a solid understanding of how to implement authentication in a Rails 8 application using the built-in generator. Remember, the key to a successful implementation lies in understanding the underlying concepts, such as session management, password hashing, and the role of the `Current` module in managing request-wide data.",
  "summary": "In Part 1 we generated a Rails 8 app and followed a request from route to controller. Today Study Flow gets its first real feature: users . Before this Rails version, most people added a gem like Devise to get login. Rails 8 ships its own authentication generator . It writes plain Ruby code into your app, so you can read all of it, and that's exactly what we'll do. What you'll learn Running the…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}