### Home Classes Methods

### In Files

- lib/authlogic/session/password.rb

### Methods

- #find_by_login_method
- #find_by_login_method=
- #generalize_credentials_error_messages
- #generalize_credentials_error_messages=
- #login_field
- #login_field=
- #password_field
- #password_field=
- #verify_password_method
- #verify_password_method=

### Files

- LICENSE
- README.rdoc

### Class/Module Index

Quicksearch

- Authlogic
- Authlogic::ActsAsAuthentic
- Authlogic::ActsAsAuthentic::Base
- Authlogic::ActsAsAuthentic::Base::Config
- Authlogic::ActsAsAuthentic::Email
- Authlogic::ActsAsAuthentic::Email::Config
- Authlogic::ActsAsAuthentic::Email::Methods
- Authlogic::ActsAsAuthentic::LoggedInStatus
- Authlogic::ActsAsAuthentic::LoggedInStatus::Config
- Authlogic::ActsAsAuthentic::LoggedInStatus::Methods
- Authlogic::ActsAsAuthentic::LoggedInStatus::Methods::InstanceMethods
- Authlogic::ActsAsAuthentic::Login
- Authlogic::ActsAsAuthentic::Login::Config
- Authlogic::ActsAsAuthentic::Login::Methods
- Authlogic::ActsAsAuthentic::MagicColumns
- Authlogic::ActsAsAuthentic::MagicColumns::Methods
- Authlogic::ActsAsAuthentic::Password
- Authlogic::ActsAsAuthentic::Password::Callbacks
- Authlogic::ActsAsAuthentic::Password::Config
- Authlogic::ActsAsAuthentic::Password::Methods
- Authlogic::ActsAsAuthentic::Password::Methods::InstanceMethods
- Authlogic::ActsAsAuthentic::PerishableToken
- Authlogic::ActsAsAuthentic::PerishableToken::Config
- Authlogic::ActsAsAuthentic::PerishableToken::Methods
- Authlogic::ActsAsAuthentic::PerishableToken::Methods::ClassMethods
- Authlogic::ActsAsAuthentic::PerishableToken::Methods::InstanceMethods
- Authlogic::ActsAsAuthentic::PersistenceToken
- Authlogic::ActsAsAuthentic::PersistenceToken::Methods
- Authlogic::ActsAsAuthentic::PersistenceToken::Methods::ClassMethods
- Authlogic::ActsAsAuthentic::PersistenceToken::Methods::InstanceMethods
- Authlogic::ActsAsAuthentic::RestfulAuthentication
- Authlogic::ActsAsAuthentic::RestfulAuthentication::Config
- Authlogic::ActsAsAuthentic::RestfulAuthentication::InstanceMethods
- Authlogic::ActsAsAuthentic::SessionMaintenance
- Authlogic::ActsAsAuthentic::SessionMaintenance::Config
- Authlogic::ActsAsAuthentic::SessionMaintenance::Methods
- Authlogic::ActsAsAuthentic::SingleAccessToken
- Authlogic::ActsAsAuthentic::SingleAccessToken::Config
- Authlogic::ActsAsAuthentic::SingleAccessToken::Methods
- Authlogic::ActsAsAuthentic::SingleAccessToken::Methods::InstanceMethods
- Authlogic::ActsAsAuthentic::ValidationsScope
- Authlogic::ActsAsAuthentic::ValidationsScope::Config
- Authlogic::AuthenticatesMany
- Authlogic::AuthenticatesMany::Association
- Authlogic::AuthenticatesMany::Base
- Authlogic::ControllerAdapters
- Authlogic::ControllerAdapters::AbstractAdapter
- Authlogic::ControllerAdapters::MerbAdapter
- Authlogic::ControllerAdapters::MerbAdapter::MerbImplementation
- Authlogic::ControllerAdapters::RailsAdapter
- Authlogic::ControllerAdapters::RailsAdapter::AuthlogicLoadedTooLateError
- Authlogic::ControllerAdapters::RailsAdapter::RailsImplementation
- Authlogic::ControllerAdapters::SinatraAdapter
- Authlogic::ControllerAdapters::SinatraAdapter::Adapter
- Authlogic::ControllerAdapters::SinatraAdapter::Adapter::Implementation
- Authlogic::ControllerAdapters::SinatraAdapter::Controller
- Authlogic::ControllerAdapters::SinatraAdapter::Cookies
- Authlogic::CryptoProviders
- Authlogic::CryptoProviders::AES256
- Authlogic::CryptoProviders::BCrypt
- Authlogic::CryptoProviders::MD5
- Authlogic::CryptoProviders::Sha1
- Authlogic::CryptoProviders::Sha256
- Authlogic::CryptoProviders::Sha512
- Authlogic::CryptoProviders::Wordpress
- Authlogic::I18n
- Authlogic::I18n::Translator
- Authlogic::Random
- Authlogic::Regex
- Authlogic::Session
- Authlogic::Session::Activation
- Authlogic::Session::Activation::ClassMethods
- Authlogic::Session::Activation::InstanceMethods
- Authlogic::Session::ActiveRecordTrickery
- Authlogic::Session::ActiveRecordTrickery::ClassMethods
- Authlogic::Session::ActiveRecordTrickery::InstanceMethods
- Authlogic::Session::Base
- Authlogic::Session::BruteForceProtection
- Authlogic::Session::BruteForceProtection::Config
- Authlogic::Session::BruteForceProtection::InstanceMethods
- Authlogic::Session::Callbacks
- Authlogic::Session::Cookies
- Authlogic::Session::Cookies::Config
- Authlogic::Session::Cookies::InstanceMethods
- Authlogic::Session::Existence
- Authlogic::Session::Existence::ClassMethods
- Authlogic::Session::Existence::InstanceMethods
- Authlogic::Session::Foundation
- Authlogic::Session::Foundation::ClassMethods
- Authlogic::Session::Foundation::InstanceMethods
- Authlogic::Session::HttpAuth
- Authlogic::Session::HttpAuth::Config
- Authlogic::Session::HttpAuth::InstanceMethods
- Authlogic::Session::Id
- Authlogic::Session::Klass
- Authlogic::Session::Klass::Config
- Authlogic::Session::Klass::InstanceMethods
- Authlogic::Session::MagicColumns
- Authlogic::Session::MagicColumns::Config
- Authlogic::Session::MagicColumns::InstanceMethods
- Authlogic::Session::MagicStates
- Authlogic::Session::MagicStates::Config
- Authlogic::Session::MagicStates::InstanceMethods
- Authlogic::Session::Params
- Authlogic::Session::Params::Config
- Authlogic::Session::Params::InstanceMethods
- Authlogic::Session::Password
- Authlogic::Session::Password::Config
- Authlogic::Session::Password::InstanceMethods
- Authlogic::Session::PerishableToken
- Authlogic::Session::Persistence
- Authlogic::Session::Persistence::ClassMethods
- Authlogic::Session::Persistence::InstanceMethods
- Authlogic::Session::PriorityRecord
- Authlogic::Session::Scopes
- Authlogic::Session::Scopes::ClassMethods
- Authlogic::Session::Scopes::InstanceMethods
- Authlogic::Session::Session
- Authlogic::Session::Session::Config
- Authlogic::Session::Session::InstanceMethods
- Authlogic::Session::Timeout
- Authlogic::Session::Timeout::Config
- Authlogic::Session::Timeout::InstanceMethods
- Authlogic::Session::UnauthorizedRecord
- Authlogic::Session::Validation
- Authlogic::Session::Validation::Errors
- Authlogic::TestCase
- Authlogic::TestCase::MockController
- Authlogic::TestCase::MockLogger
- Authlogic::TestCase::RailsRequestAdapter
- Object

No matching classes.

# Authlogic::Session::Password::Config

Password configuration

### Public Instance Methods

find_by_login_method(value = nil) click to toggle source

Authlogic tries to validate the credentials passed to it. One part of validation is actually finding the user and making sure it exists. What method it uses the do this is up to you.

Let’s say you have a UserSession that is authenticating a User. By default UserSession will call User.find_by_login(login). You can change what method UserSession calls by specifying it here. Then in your User model you can make that method do anything you want, giving you complete control of how users are found by the UserSession.

Let’s take an example: You want to allow users to login by username or email. Set this to the name of the class method that does this in the User model. Let’s call it “find_by_username_or_email”

    class User < ActiveRecord::Base
      def self.find_by_username_or_email(login)
        find_by_username(login) || find_by_email(login)
      end
    end

Now just specify the name of this method for this configuration option and you are all set. You can do anything you want here. Maybe you allow users to have multiple logins and you want to search a has_many relationship, etc. The sky is the limit.

- `Default:` "find_by_smart_case_login_field"

- `Accepts:` Symbol or String

    # File lib/authlogic/session/password.rb, line 40
    def find_by_login_method(value = nil)
      rw_config(:find_by_login_method, value, "find_by_smart_case_login_field")
    end

Also aliased as: find_by_login_method=
find_by_login_method=(value = nil) click to toggle source
Alias for: find_by_login_method
generalize_credentials_error_messages(value = nil) click to toggle source

The text used to identify credentials (username/password) combination when a bad login attempt occurs. When you show error messages for a bad login, it’s considered good security practice to hide which field the user has entered incorrectly (the login field or the password field). For a full explanation, see www.gnucitizen.org/blog/username-enumeration-vulnerabilities/

Example of use:

    class UserSession < Authlogic::Session::Base
      generalize_credentials_error_messages true
    end

    This would make the error message for bad logins and bad passwords look identical:

    Login/Password combination is not valid

    Alternatively you may use a custom message:

    class UserSession < AuthLogic::Session::Base
      generalize_credentials_error_messages "Your login information is invalid"
    end

    This will instead show your custom error message when the UserSession is invalid.

The downside to enabling this is that is can be too vague for a user that has a hard time remembering their username and password combinations. It also disables the ability to to highlight the field with the error when you use form_for.

If you are developing an app where security is an extreme priority (such as a financial application), then you should enable this. Otherwise, leaving this off is fine.

- `Default` false

- `Accepts:` Boolean

    # File lib/authlogic/session/password.rb, line 77
    def generalize_credentials_error_messages(value = nil)
      rw_config(:generalize_credentials_error_messages, value, false)
    end

Also aliased as: generalize_credentials_error_messages=
generalize_credentials_error_messages=(value = nil) click to toggle source
Alias for: generalize_credentials_error_messages
login_field(value = nil) click to toggle source

The name of the method you want Authlogic to create for storing the login / username. Keep in mind this is just for your Authlogic::Session, if you want it can be something completely different than the field in your model. So if you wanted people to login with a field called “login” and then find users by email this is compeltely doable. See the find_by_login_method configuration option for more details.

- `Default:` klass.login_field || klass.email_field

- `Accepts:` Symbol or String

    # File lib/authlogic/session/password.rb, line 89
    def login_field(value = nil)
      rw_config(:login_field, value, klass.login_field || klass.email_field)
    end

Also aliased as: login_field=
login_field=(value = nil) click to toggle source
Alias for: login_field
password_field(value = nil) click to toggle source

Works exactly like login_field, but for the password instead. Returns :password if a login_field exists.

- `Default:` :password

- `Accepts:` Symbol or String

    # File lib/authlogic/session/password.rb, line 98
    def password_field(value = nil)
      rw_config(:password_field, value, login_field && :password)
    end

Also aliased as: password_field=
password_field=(value = nil) click to toggle source
Alias for: password_field
verify_password_method(value = nil) click to toggle source

The name of the method in your model used to verify the password. This should be an instance method. It should also be prepared to accept a raw password and a crytped password.

- `Default:` "valid_password?"

- `Accepts:` Symbol or String

    # File lib/authlogic/session/password.rb, line 108
    def verify_password_method(value = nil)
      rw_config(:verify_password_method, value, "valid_password?")
    end

Also aliased as: verify_password_method=
verify_password_method=(value = nil) click to toggle source
Alias for: verify_password_method

[Validate]

Generated with the Darkfish Rdoc Generator 2.