search

heartcombo / devise

Flexible authentication solution for Rails with Warden.
http://blog.plataformatec.com.br/tag/devise/
MIT License
24.02k stars 5.55k forks source link

"Encrypted password" is actually "Hash" of the password. Does it need to be renamed? #5654

Open Ashwintrn opened 1 year ago

Ashwintrn commented 1 year ago

Currently, the column designated for the hashed value of the password is named "encrypted_password". While I understand the historical context, I've noticed that this term could potentially be a bit misleading for some users. For clarity and user experience, It would be helpful to rename this column to something like "password_hash" or another relatable name. If suitable/possible we can just give an alias_name in the codebase. This adjustment could help avoid confusion and create a more intuitive environment for users interacting with the database directly. Much Appreciate your work. TIA.

rnestler commented 3 months ago

I also was confused / amused by the encrypted_password name. Note that in the code it mentions that it is named like this for legacy reasons:

https://github.com/heartcombo/devise/blob/a259ff3c28912a27329727f4a3c2623d3f5cb6f2/lib/devise/models/database_authenticatable.rb#L62-L68

How would one implement a rename of the field in a backwards compatible manner? I imagine something like this:

  1. Add password_hash alias to database_authenticatable: This allows to use password_hash in most places in the code, without needing to change anything else.
  2. Rename the encrypted_password field in the DB to password_hash, the generated migrations, providing an update path when upgrading the gem and add a deprecated alias encrypted_password to the new password_hash

Or maybe allow to use either password_hash or encrypted_password as the DB field name as an intermediate step?