How do I require that a password has a minimum length when using has\_secure\_password in Rails 3.1? I tried to do:

```
class User < ActiveRecord::Base
    ... 
    validates :password, presence: { on: create }, length { minimum: 8 }
    ...
end

```

but then the validation fails with password "too short" on update when password is not provided in form params. For other attributes length is only validated if the value for the field is provided. Is this a bug in the has\_secure\_password implementation or am I doing something wrong?