Carefully inspecting the debug information in Figure 8.5 shows that, as hinted at the end of Section 8.1.3, the submission results in a params hash containing the email and password under the key :session:

As with the case of user signup (Figure 7.15) these parameters form a nested hash like the one we saw in Listing 4.6. In particular, params contains a nested hash of the form

This means that

is itself a hash:

  As a result,

  is the submitted email address and

s the submitted password.

In other words, inside the create action the params hash has all the information needed to authenticate users by email and password. Not coincidentally, we already have exactly the methods we need: the User.find_by_email method provided by Active Record (Section 6.1.4) and the authenticate method provided by has_secure_password (Section 6.3.3). Recalling that authenticate returns false for an invalid authentication, our strategy for user signin can be summarized as follows: