Episode 236, when register with twitter or facebook

[TeuF]

Hi,

I have a problem: if I register using twitter or facebook instance, the password field stay blank. Then if the user try to login using email + password

I get the following error:

BCrypt::Errors::InvalidHash in Devise/sessionsController#create
invalid hash

How can I prevent this to happen ?

Thanks a lot.

[jpmckinney]

This is because the encrypted_password field is empty. Seeding the password with a random string when people create users via Twitter/Facebook/etc. will avoid this problem.

[ryanjm]

If you do that, won't it stop them from being able to add a password later?

Ideally, it would return saying that email/password is incorrect, right?

[jpmckinney]

Yes, it would, but if they are logging in with Facebook, they don't need a password on your site (right?).

[ryanjm]

It's true, I just happen to let the user be able to login multiple ways. Idea is that authentication != identification, so why not let the user be able to login through multiple means?

[jpmckinney]

In that case, I would require users to set a password on your site when they login with Facebook for the first time.