ruby - What is a secure way for user to update password, can't get form_for to call the right action in Rails 4? -

I have a form where I want to make the user change my password. I do not like Devise or anything like that. Do not use Before changing your password, I want to enter my current password, and I want to do it safely. The form looks something like this:

  -------------------- I present password I --------- ----------- -------------------- I password I ---------------- ---- -------------------- I confirm the password I ------------------- - - ------------- I submit to ---------------  

My In UsersController, I have two ways, which look like this:

  def edit_password end def change_password # is probably not correct, but I have to make sure that the user is changing password First present pass Password is correct if @ user.authenticate (params [: current_password]) response_to do | Format | If @ user.update_attributes (user_params) format.html {redirect_to (@user ,: notice = & gt; 'your account was successfully updated'}} format.json {response_with_bip (@user)} and format.html {rendere : Action = & gt; "edit"} format.json {response_with_bip (@user)} end end else redirect_to edit_user_path (@user), notice: "your current password was incorrect" End End  

The form appears in my editing mode, my paths look like this:

  Resources: Users receive 'edit_password': By adding 'users # edit_password' to 'change_password' : "Users # change_password" en D  

My form looks like this:

  = form_for URL: url = & gt; User_change_password_path (@user); f | .form-group = f.label: current_password = f.text_field: current_password .form-group = f.label: password = f.password_field: password .form-group = f.label: password_confirmation = f.password_field: password_confirmation .form - Responses = f.submit "Update Account"  

In my user model I have attr_accessor: current_password .

When I click Submit I currently get this error:

  No routes matched [patch] "/ user / 1 / change_password"  

So, how can I work it out, my current view is safe, and if not, what should I change?

To fix the issue of routes, please change it on your config / routes.rb: By entering 'change_password': "users # change_password"

with:

  patch 'change_password' For: "users # change_password"  

Because clearly the patch alias is not defined.

The way you are doing is very standard, authenticate with old password and then change it.

Maybe you want to delete the ID from the URL and just want to change the password of the current user, but I have no problem with this because you are demanding the current password.