Resetting a password
Below is refactoring code you can use:

def set_new_password
  @user = User.find_by(password_reset_token: params[:password_reset_token]) if params[:password_reset_token].present?

  unless user
    render json: {
       errors: ["Password reset not found. Please request a new password reset!"]
    }, status: 404 and return
  end

  if params[:password] != params[:password_confirmation]
    render json: { errors: ["Your password confirmation doesn't match"] }, status: :unprocessable_entity

  elsif @user.password_reset_sent_at &lt; 2.hours.ago
    render json: {
      errors: ["Your password reset expired. Please require a new password reset from the app."]
    }, status: :unprocessable_entity

  else
    updated_params = user_params.merge(password_reset_token: nil, password_reset_sent_at: nil)

    @user.update(updated_params) ?
      render :json =&gt; {:success =&gt; true} :
      render :json =&gt; {:success =&gt; false}
  end
end


I also suggest to move validation password confirmation match with password to model using standard ActiveRecord validation: http://guides.rubyonrails.org/active_record_validations.html#confirmation