Creating a secure login in ruby on rails - ruby-on-rails

Question

I am trying to create a secure login that will require a username and password. I am struggling with this and can not figure out the problem. When I try to access my login page I receive an error for <%= form_tag login_url do %> in the login page. If anyone can help me make this work, you will be my hero.
Schema for table that holds username and password
create_table "users", force: true do |t|
t.string "name"
t.string "password_digest"
t.string "password"
t.string "password_confirmation"
t.datetime "created_at"
t.datetime "updated_at"
end
Controller from the table that holds username and password
class User < ActiveRecord::Base
has_secure_password
end
The login page (which I can not get to work)
<h2>The Maintenance Functions are restricted to authorized users. Please login below</h2>
<%= form_tag login_url do %>
<p>
<label for="name">Name:</label>
<%= text_field_tag :name, params[:name] %>
</p>
<p>
<label for="password">Password:</label>
<%= password_field_tag :password, params[:password] %>
</p>
<%= submit_tag "login" %>
<% end %>
The controller for the login page
class SessionsController < ApplicationController
def new
end
def create
user = User.find_by_name(params[:name])
if user and user.authenticate(params[:password])
session[:user_id] = user.id
redirect_to secertin_secertout_path :notice => "Logged in successfully"
else
flash.alert = "Invalid userid/password combination"
render 'new'
end
end
def destroy
session[:user_id] = nil
redirect_to root_url_path :notice => "Logged Out"
end
end

Answer 1

You'll be best using Devise (or maybe Authlogic)
Reason being it's sometimes better to outsource something as important as user authentication. Why? Several reasons:
it's a vital part of your app
it needs to adapt with changes in HTTP security
it needs to work with other dependencies
If you roll your own authentication (which isn't that difficult), your major issue is you won't have the extensibility or reliability that one of these solutions provides. I would highly recommend using devise - it's doing exactly what you need anyway

Answer 2

Remove the password and password_confirmation columns from your table and your code should work. has_secure_password gives you the virtual attributes password and password_confirmation but it stores a hashed version of the password in your table in the password_digest column. Not storing the plain text version of the password in the database is part of what makes has_secure_password secure.