All threads / Rails for Beginners Part 19: Edit Password Discussion
Ask A Question


You’re not receiving notifications from this thread.

Rails for Beginners Part 19: Edit Password Discussion

Editing the password with an empty string (i.e. not filling the fields and clicking right away on the submit button) doesn't throw any error, Current.user.update(password_params) returns true and the redirection is working. However, the password is not changed in the database. I don't get how it is possible that the update method returns true but at the same time, the database is not updated and there is not even a error message in the logs.

maybe you should authenticate the form using html and javascript or doing something like this

I tried but not worked here for me, so, I should use some regex in html and javascript, but I think rails has a better way.

Yes, you can simply add this in your user model: "validates :password, presence: true". Thus, it's attaching an error "Password can't be blank" to your model's instance which is displayed on the edit view. What I don't understand is that, when you don't add this validation and submit an empty form, you do get redirected to the rootpah with the notice "password updated!", which means Current.user.update(password_params) is working. So I would expect the password to be changed to an empty string, but it is not the case. The password remains unchanged. I hope it makes sense, sorry, english is not my native language.

Ok, so answering to myself: this is a default implementation (discussed here: And the reason for this implementation is, I quote: "the reason the password is ignored for empty strings is that if a user has a form with multiple fields (including password) and they update details but don't enter the password, then we want to allow the other details to be updated without the password being effected.". Makes sense eventually :)

Nice catch! That was really interesting to learn & try.

I had the exact same question. Thanks for this thread and answers!

For that, I just added validates to my user model, like that:

class User < ApplicationRecord

  validates :email, presence: true, format: {
    with: URI::MailTo::EMAIL_REGEXP,
    message: 'invalid email address provided'

  validates :password, presence: true

I'm having an issue where it does not validate the confirmation to the new password. So no matter if the two are different, it simply updates the password with whatever is in the password field.

Scratch that... no issue. My poor spelling was the problem. Only took 45 minutes to figure that out. :/

By the way, what's the reason that you've created a bang method called require_user_signed_in!. I know the general idea behind bang methods but how does that apply here? Why not just require_user_signed_in?

I did not notice ! at the end of method name. Wondering if that was intentional..

It's okay to put the if conditional at the end of the require_user_logged_in! method? Huh…

I was getting the error: Error: Form responses must redirect to another location in my dev tools (and the change password button was also not throwing any flash messages). I had to add status: :unprocessable_entity to my passwords_controller.rb file. Full code:

class PasswordsController < ApplicationController 
    before_action :require_user_logged_in!

    def edit

    def update
        if Current.user.update(password_params)
           redirect_to root_url, notice: 'パスワードを変更しました'
           render :edit, status: :unprocessable_entity


    def password_params
        params.require(:user).permit(:password, :password_confirmation)

Hi, I had to add the status too, Rails v7 in my case requires this part.

Join the discussion

Want to stay up-to-date with Ruby on Rails?

Join 70,078+ developers who get early access to new tutorials, screencasts, articles, and more.

    We care about the protection of your data. Read our Privacy Policy.

    logo Created with Sketch.

    Screencast tutorials to help you learn Ruby on Rails, Javascript, Hotwire, Turbo, Stimulus.js, PostgreSQL, MySQL, Ubuntu, and more. Icons by Icons8

    © 2023 GoRails, LLC. All rights reserved.