Rails - Skipping password validation, allow_nil safe? -

i split password update functionality off user profiles users can update profiles without being hassled password. profile update page no longer using the _form partial, got own view @ profileedit.html.erb.

the profile edit view did not have password fields, of course didn't stop validations preventing updates. tried number of ways skip validation, experienced frustration, drank coffee, , came upon solution here: https://quickleft.com/blog/rails-tip-validating-users-with-has_secure_password/

it works great. long using has_secure_password, 1 needs add 'allow_nil: true' end of password validation. if go password update page , save without entering anything, doesn't overwrite password blank, , validations still apply if enter something.

like said, seems to work great. i'm concerned missing something. issues should aware of?

the pertinent bit model:

has_secure_password   validates :password, presence: true, length: { minimum: 6 }, allow_nil: true