ActiveRecord has_secure_password

0-model

$ rails g model User email password_digest

user.rb

class User < ActiveRecord::Base
  has_secure_password
end

z-sessions_controller.rb

class SessionsController < ApplicationController
  def create
    user = User.find_by(email: params[:email])
    if user && user.authenticate(params[:password])
      login(user)
      redirect_to root_url, notice: 'Signed in successfully'
    else
      flash.alert 'Email and password do not match'
      render :new
    end
  end
end