Authlogic: the session-as-a-model authentication library

Plugin histories · By the Gemfile Review editorial team · Published 2026-10-24

A brass cylinder lock set into an old wooden door — A brass cylinder lock in a worn wooden door.

Authlogic is one of the few authentication libraries from the Rails 2 era that is still maintained. Its central idea, treating a login session like an Active Record model, made it popular before Devise, and it still has a loyal following.

What Authlogic does

Most authentication libraries give you controllers and views. Authlogic gives you two building blocks and leaves the rest to you:

acts_as_authentic in your user model, which adds password hashing, validation of login and email fields, persistence tokens and related helpers;
a session class inheriting from Authlogic::Session::Base, which behaves much like a model: you create it to sign in and destroy it to sign out.

class UserSession < Authlogic::Session::Base
end

class UserSessionsController < ApplicationController
  def create
    @user_session = UserSession.new(user_session_params.to_h)
    if @user_session.save
      redirect_to dashboard_path
    else
      render :new, status: :unprocessable_entity
    end
  end

  def destroy
    current_user_session&.destroy
    redirect_to root_path
  end
end

Because the session object has validations and errors like a model, sign-in forms can use the same form helpers and error display as any other form. Authlogic also handles "remember me" cookies, session timeouts, brute-force protection through a consecutive failed logins limit, single-access tokens for API or feed access, and magic columns such as login_count and last_login_at that it updates automatically when they exist.

The controllers, views, password reset flow and email confirmation are yours to write. That is the trade-off: more code in your application, but no engine to override.

History and status

Authlogic was created by Ben Johnson (GitHub user binarylogic) in 2008, at a time when most applications used the restful_authentication generator. It quickly became one of the most widely used Rails authentication plugins of the Rails 2.3 and Rails 3 period, before Devise became the default choice for most new applications.

Unlike many libraries of that era, it has continued to be released. According to RubyGems.org, the latest version at the time of writing is 6.6.0, published in November 2025. Its runtime dependencies declare support for Active Record, Active Model and Active Support from 7.2 up to (but not including) 8.2, so it works with Rails 7.2, 8.0 and 8.1. Major versions over the years have removed deprecated features and changed defaults, so upgrading an old installation is best done one major version at a time, following the changelog.

Password hashing in old installations

Applications that adopted Authlogic many years ago may still hash passwords with an older crypto provider. Authlogic supports several providers, including BCrypt and SCrypt, and lets you list previous providers with transition_from_crypto_providers, so that users' hashes are upgraded transparently the next time they sign in. If you inherit such an application, check which provider is configured and plan the transition; the project's README and changelog describe the options for your version.

Should you choose Authlogic today?

For an existing application that uses it, yes, keep it: it is maintained, it supports current Rails, and replacing an authentication system is risky work with little benefit. Keep it updated and run bundle-audit in CI as for any other dependency.

For a new application, compare it with the alternatives covered in our authentication guide:

Option	Compared with Authlogic
Rails 8 authentication generator	Similar philosophy (your own controllers), but no dependency at all: the code is generated into your app.
Devise	Far more ready-made flows and integrations; more behaviour hidden inside an engine.
Rodauth	Much broader feature set, including MFA and passkeys; different architecture.
Clearance, Sorcery	Comparable scope; different APIs.

The Rails generator has taken over much of the ground that made Authlogic attractive: a thin layer you understand completely. If you like Authlogic's model-based session object, it remains a sound and supported choice.

Extensions from the plugin era

Several companion plugins grew around Authlogic in the Rails 2 and 3 years, for OAuth or OpenID login and for helper methods. Most of them have not been updated in many years. For login with external providers today, use OmniAuth strategies, and link the external identity to your Authlogic user yourself.

Authlogic: the session-as-a-model authentication library

What Authlogic does

History and status

Password hashing in old installations

Should you choose Authlogic today?

Extensions from the plugin era

Further reading

Read next

Authentication

Authorization

Webrat