Justin Britten

How to Change or Reset your Password with RESTful_authentication

I have used the acts_as_authenticated plugin for quite some time. It works well, and there’s lots of documentation. I’ve been happy with it. Mostly. I say mostly because it has always bothered me that acts_as_authenticated generates unRESTful code, which is tainting my perfectly RESTful application.

So, I recently evaluated the restful_authentication plugin. The plugin works great, but it is lacking the same breadth of documentation. I needed to add the ability handle a lost password and to change a password. Here’s what I did:

1. Create a new Passwords controller.

The new/create actions equate to a lost password (user wants to get a new password). The edit/update actions equate to changing a password (user wants to update their password).

When a user forgets their password and requests a new one, both their login and email will be required. If this login and email pair exists, then a new, random password will be generated and emailed.

When a user desires a new password, they are required to enter their old password in addition to typing and confirming a new password. The old password is required for security sake.

class PasswordsController < ApplicationController
  before_filter :login_from_cookie
  before_filter :login_required, :except => [:create]

  # Don't write passwords as plain text to the log files
  filter_parameter_logging :old_password, :password, :password_confirmation

  # GETs should be safe
  verify :method => :post, :only => [:create], :redirect_to => { :controller => :site }
  verify :method => :put, :only => [:update], :redirect_to => { :controller => :site }

  # POST /passwords
  # Forgot password
  def create
    respond_to do |format|

      if user = User.find_by_email_and_login(params[:email], params[:login])
        @new_password = random_password
        user.password = user.password_confirmation = @new_password
        user.save_without_validation
        UserNotifier.deliver_new_password(user, @new_password)

        format.html {
          flash[:notice] = "We sent a new password to #{params[:email]}"
          redirect_to signin_path
        }
      else
        flash[:notice] =  "We can't find that account.  Try again."
        format.html { render :action => "new" }
      end
    end
  end

  # GET /users/1/password/edit
  # Changing password
  def edit
    @user = current_user
  end

  # PUT /users/1/password
  # Changing password
  def update
    @user = current_user

    old_password = params[:old_password]

    @user.attributes = params[:user]

    respond_to do |format|
      if @user.authenticated?(old_password) && @user.save
        format.html { redirect_to user_path(@user) }
      else
        format.html { render :action => 'edit' }
      end
    end
  end

  protected

  def random_password( len = 20 )
    chars = (("a".."z").to_a + ("1".."9").to_a )- %w(i o 0 1 l 0)
    newpass = Array.new(len, '').collect{chars[rand(chars.size)]}.join
  end

end

2. Here is the change password view (edit.html.erb):

<div class="form_container">
    <%= error_messages_for :user %>

    <% form_for(:user, :url => user_password_path(@user), :html => { :method => :put }) do |f| %>
      <fieldset>
<div class="form_row">
          <label for="password">Old password</label>
<%= password_field_tag :old_password %></div>
<div class="form_row">
          <label for="password">New password</label>
          <%= f.password_field :password %></div>
<div class="form_row">
          <label for="password_confirmation">Retype the new password</label>
          <%= f.password_field :password_confirmation %></div>
<div class="submit_row">
          <%= f.submit "Update", :class => "submit" %> or <%= link_to 'Cancel', home_path %></div>
</fieldset>
    <% end %></div>

3. Here is the new password view (new.html.erb):

<div class="form_container">
    <% form_for(:password, :url => passwords_path) do |f| %>
      <fieldset>
<div class="form_row">
          <label for="login">Username</label>
          <%= text_field_tag 'login' %></div>
<div class="form_row">
          <label for="email">Email</label>
          <%= text_field_tag 'email' %></div>
<div class="submit_row">
          <%= submit_tag 'Send Password', :class => "button-to" %></div>
</fieldset>
    <% end %></div>

4. Here’s the user notifier (emailer) code:

You’ll need a user_notifier.rb file and a view template (app/views/user_notifier/new_password.html.erb) which will just contain the text of the email you want to send.

app/models/user_notifier.rb:

class UserNotifier < ActionMailer::Base
  def new_password(user, new_password)
    setup_email(user)
    @subject    += 'Your new password'
    @body[:new_password]  = new_password
  end

  protected

  def setup_email(user)
    @recipients  = "#{user.email}"
    @from        = "Support" "<support@yoursite.com>"
    @subject     = ""
    @sent_on     = Time.now
    @body[:user] = user
  end
end

app/views/user_notifier/new_password.html.erb:

We’re sorry to hear your lost your password. But, there’s no need to worry, because we’ve created a new, temporary password for you.

Your new password is: <%=h @new_password %>

You can change this password to something more memorable once you log into your account.

5. Here’s the modified routes.rb file:

  map.resources :passwords
  map.resources :users, :has_one => [:password]

Tags: rails