upto 3.12: added password + validation

app/controllers/sessions_controller.rb

@@ -4,11 +4,12 @@ class SessionsController < ApplicationController
 
   def create
     user = User.find_by username: params[:username]
-    if user.nil?
-      redirect_to signin_path, notice: "User #{params[:username]} does not exist!"
-    else
+
+    if user && user.authenticate(params[:password])
       session[:user_id] = user.id if user
-      redirect_to user
+      redirect_to user_path user, notice: "Welcome back :)"
+    else
+      redirect_to signin_path, notice: "Incorrect username or password"
     end
   end
 

app/controllers/users_controller.rb

@@ -26,7 +26,7 @@ class UsersController < ApplicationController
 
     respond_to do |format|
       if @user.save
-        format.html { redirect_to user_url(@user), notice: "User was successfully created." }
+        format.html { redirect_to signin_path, notice: "User was successfully created." }
         format.json { render :show, status: :created, location: @user }
       else
         format.html { render :new, status: :unprocessable_entity }
@@ -67,6 +67,6 @@ class UsersController < ApplicationController
 
   # Only allow a list of trusted parameters through.
   def user_params
-    params.require(:user).permit(:username)
+    params.require(:user).permit(:username, :password, :password_confirmation)
   end
 end