session

new.html.erb

<!-- app/views/sessions/new.html.erb -->
<div class="depot_form">
<% if flash[:alert] %>
  <p id="notice"><%= flash[:alert] %></p>
<% end %>
<%= form_tag do %>
  <fieldset>
    <legend>Please Log In</legend>
    <div>
      <%= label_tag :name, 'Name:' %>
      <%= text_field_tag :name, params[:name] %>
    </div>
    <div>
      <%= label_tag :password, 'Password:' %>
      <%= password_field_tag :password, params[:password] %>
    </div>
    <div>
      <%= submit_tag "Login" %>
    </div>
  </fieldset>
<% end %>
</div>

sessions_controller.rb

def create
  user = User.find_by_name(params[:name])
  if user and user.authenticate(params[:password])
    session[:user_id] = user.id
    redirect_to admin_url
  else
    redirect_to login_url,
       alert: "Invalid user/password combination"
  end
end