Authlogic Documentation

Authlogic requires a session model that inherits from Authlogic::Session::Base. Create this file at app/models/user_session.rb.

class UserSession < Authlogic::Session::Base
end

To install Authlogic in your Ruby project, add the gem to your Gemfile and run bundle install.

gem 'authlogic'

Create a controller to handle login and logout. The create action should use UserSession.new with permitted parameters including :login, :password, and :remember_me. The destroy action should call current_user_session.destroy.

class UserSessionsController < ApplicationController
  def new
    @user_session = UserSession.new
  end

  def create
    @user_session = UserSession.new(user_session_params.to_h)
    if @user_session.save
      redirect_to root_url
    else
      render :new, status: 422
    end
  end

  def destroy
    current_user_session.destroy
    redirect_to new_user_session_url
  end

  private

  def user_session_params
    params.require(:user_session).permit(:login, :password, :remember_me)
  end
end

To access the session and user throughout your application, add current_user_session and current_user helper methods to your ApplicationController and expose them via helper_method.

class ApplicationController < ActionController::Base
  helper_method :current_user_session, :current_user

  private
    def current_user_session
      return @current_user_session if defined?(@current_user_session)
      @current_user_session = UserSession.find
    end

    def current_user
      return @current_user if defined?(@current_user)
      @current_user = current_user_session && current_user_session.user
    end
end

Starting with version 3.4.0, the default crypto_provider changed from Sha512 to SCrypt. If you have not explicitly configured a crypto_provider and are upgrading, existing user passwords will fail authentication because the library will attempt to verify them using SCrypt instead of Sha512.

To prevent password breakage, you must either:

1. Explicitly set the provider to Sha512 to maintain compatibility with existing passwords.
2. Use the transition_from_crypto_providers option to automatically migrate users to SCrypt as they log in.

# Option 1: Maintain Sha512 to prevent password breakage
c.crypto_provider = Authlogic::CryptoProviders::Sha512

# Option 2: Automatically upgrade users from Sha512 to SCrypt upon successful login
c.transition_from_crypto_providers = [Authlogic::CryptoProviders::Sha512]
c.crypto_provider = Authlogic::CryptoProviders::SCrypt

Add the following to your config/routes.rb to support the session resource:

Rails.application.routes.draw do
  resources :users
  resource :user_session
end

In Authlogic 4.4.0, built-in validations for email, login, and password are deprecated and will be removed in version 5.0.0. You should migrate to standard ActiveRecord validations to ensure compatibility and better maintainability.

Migration Steps

1. Disable Authlogic validations: Update your acts_as_authenticatable configuration block to set the following flags to false:

   • validate_email_field
   • validate_login_field
   • validate_password_field

2. Implement ActiveRecord validations: Replace Authlogic-specific methods (like validates_length_of_email_field_options) with standard Rails validates calls.

Recommendation: Replace fields one at a time (e.g., email, then login, then password) and commit each change separately. Complete this migration before upgrading to Authlogic 5.

Within the acts_as_authentic block, you can configure cryptographic providers and session lifecycle behaviors.

Key configuration options include:

• crypto_provider: Sets how passwords are hashed (e.g., Authlogic::CryptoProviders::BCrypt).
• log_in_after_create: Controls whether a user is automatically logged in after successful registration.
• log_in_after_password_change: Controls whether the session is automatically updated after a password change.

class User < ApplicationRecord
  acts_as_authentic do |c|
    c.crypto_provider = Authlogic::CryptoProviders::BCrypt
    c.log_in_after_create = false
    c.log_in_after_password_change = false
  end
end

To enable Authlogic authentication features on an ActiveRecord model (typically a User model), call the acts_as_authentic class method. You can optionally provide a block to configure the authentication settings for that specific model.

Note: Some Authlogic modules require an existing database connection and table. If you call acts_as_authentic before the database is ready, it may raise an error depending on your raise_on_model_setup_error configuration.

class User < ApplicationRecord
  acts_as_authentic do |c|
    # configuration options go here
  end
end