6.3.2 Password and Confirmation

As seen in the mockup in Figure 6.1, we expect to have users confirm
their passwords, a common practice on the web meant to minimize typos.
We could enforce this at the controller layer, but it’s conventional to
put it in the model and use Active Record to enforce the constraint. The
method is to add password and password_confirmation attributes to the
User model, and then require that the two attributes match before the
record is saved to the database. Unlike the other attributes we’ve seen
so far, the password attributes will be virtual—they will only exist
temporarily in memory, and will not be persisted to the database. As
we’ll see in Section 6.3.4, these virtual attributes are implemented
automatically by has_secure_password.