From Rails 7.1, has_secure_password now includes a password_challenge accessor to validate it against the currently persisted password. Check out more on this here.