Internship← Ruby on Rails learning pathRuby on Rails · Module 7 of 10
Authentication and security
Logging users in safely and defending the app.
📖 Key ideas
- has_secure_password stores bcrypt hashes, never plain passwords.
- Rails 8 includes an authentication generator; Devise is a popular gem.
- CSRF tokens are added to forms automatically.
- Store secrets in credentials (bin/rails credentials:edit), not in code.
- Use authorisation checks (e.g. Pundit) so users can only touch their own data.
💡 Real-life example: Like a hostel: the gatekeeper checks ID cards (authentication), and each key opens only your own room (authorisation).
has_secure_passwordAdds bcrypt password hashing
CSRFCross-site request forgery
CredentialsEncrypted secrets file
AuthorisationWhat a logged-in user may do