This skill provides a comprehensive pattern for implementing a secure 'forgot password' flow in Ruby on Rails 8 applications without relying on external gems. It leverages Rails 8's built-in signed token generation and has_secure_password to create time-limited, single-use recovery links. The implementation follows industry-standard security best practices, including protecting user privacy by avoiding user enumeration, enforcing cryptographically secure signatures, and providing integrated mailers and controllers for a production-ready authentication experience.
主な機能
01Native Rails 8 token generation with built-in has_secure_password support
02Privacy-focused design that prevents user enumeration via unified flash messages
03Automated 15-minute token expiration with customizable timeout settings
04Complete boilerplate for controllers, mailers, and internationalized views
05Security-hardened patterns including single-use tokens and signed signatures
060 GitHub stars
ユースケース
01Adding a 'Forgot Password' feature to a new or existing Rails 8 application
02Migrating from heavy authentication gems to a lightweight, native Rails implementation
03Implementing secure, time-sensitive account recovery for production environments
