How can I sometimes require a password, and sometimes not with has_secure_password?

Question

My application allows people to register using a password or using Facebook.

Even when I remove password checks from my User model, I get :password_digest => ["can't be blank"] in the user model.

I am using has_secure_password .

How can I make password_digest NOT mandatory?

Answer 1

You can not. has_secure_password automatically adds two validators to your model:

 validates_confirmation_of :password validates_presence_of :password_digest 

Instead, set a dummy value for password_digest for users who do not have a password:

 user.password = user.password_confirmation = "" user.password_digest = "facebook-authorized account" 

This is safe because the password cannot be hashed to match this digest.

Answer 2

Later commits added hash parameters to has_secure_password , which allows you to skip checks for the password_digest field. You use it as follows:

  has_secure_password :validations => false 

This, unfortunately, is not in rails version 3.2.13. See fooobar.com/questions/324925 / ...