Authentication without has_secure_password - ruby-on-rails

Question

I'm trying to do a custom authentication to better understand what's going on under the hood. It took a while to get it to accept password and password_confirmation, but now it just wont work and I'm all out of ideas
class UsersController < ApplicationController
def new
#user = User.new
end
def create
par = params[:user]
#user = User.new(params[:user])
if #user.verify_password_confirmation(par[:password], par[:password_confirmation]) && #user.save
sign_in #user
redirect_to user_url(#user)
else
render 'new'
end
end
end
Is there any danger to having password and password_confirmation in attr_accessor?
require 'bcrypt'
class User < ActiveRecord::Base
attr_accessor :password_confirmation, :password
attr_accessible :name, :email, :password, :password_confirmation
before_save { email.downcase! }
validates :name, presence: true, length: { maximum: 50 }
VALID_EMAIL_REGEX = /\A[\w+\-.]+#[a-z\d]\-.]+\.[a-z]+\z/i
validates :email, presence: true,
format: { with: VALID_EMAIL_REGEX },
uniqueness: { case_sensitive: false }
validates :password, length: { minimum: 6 }
validates :password_confirmation, presence: true
def password=(password)
self.password_digest = BCrypt::Password.create(password)
end
def verify_password(password) #for the sessions, which obviously I can't check yet
BCrypt::Password.new(self.password_digest) == password
end
def verify_password_confirmation(pass, pass_con) #couldn't see how else to confirm it
pass_con == pass
end
def reset_session_token!
self.session_token = SecureRandom::base64(32)
self.save!
self.session_token
end
end
EDIT: Specifically the problem is that it's failing at either the #user.save or the verify_password_confirmation and re-rendering

Answer 1

Look at secure_password.rb on github. has_secure_password is much more simple, clear and easy to understand than other third party authentication gems or plugins.
Also note that has_secure_password uses bcrypt-ruby gem for generating password_digest. So if you want to roll your own authenticating system then you will want to think about its security as well.