Editing/Updating user not working when using has_secure_password in Rails 4

Question

I am using Michael Hartl's Ruby on Rails tutorial to make my own user auth system. Everything is working fine when creating a new user. When trying to update a user is when things are no longer making sense. I am using the `has_secure_password` method. So I let it worry about taking the password and encrypting it. But when I update, some weird behavior occurs. The important part is that I can update a user without entering any password and its confirmation. But if I enter a password and no confirmation, it requires a confirmation. If I only enter a confirmation password, that updates with no error. Now since `has_secure_paassword` is suppose to be doing that part, why is it not doing it when updating? One thing I did not add in my User model is a presence validation due to this line in the tutorial: Presence validations for the password and its confirmation are automatically added by has_secure_password. I am aware that there are similar questions on this, but none seem to enforce str…

Accepted Answer

Since this is an `update` action instead of a `create` the validations might not be running.

From ActiveModel::SecurePassword:

Validations for presence of password on create, confirmation of password (using a password_confirmation attribute) are automatically added.

Relevant section of code from secure_password.rb

```
def has_secure_password(options = {})
  ...
  if options.fetch(:validations, true)
    validates_confirmation_of :password, if: lambda { |m| m.password.present? }
    validates_presence_of     :password, :on => :create
    validates_presence_of     :password_confirmation, if: lambda { |m| m.password.present? }
  end
  ...
end
```

Editing/Updating user not working when using has_secure_password in Rails 4

Solution

Problem