Find_for_database_authentication vs Find_by in Rai

问题:

So, I'm trying to set up a React frontend and Rails backend with devise, and the Rails side is supposed to be an internal API. It's the first time I've ever done this, so I'm struggling with authentication. Specifically, in my SessionsController, I have this code:

def create
  resource = User.find_for_database_authentication(email: params[:email])
  return invalid_login_attempt unless resource 

  if resource.valid_password?(params[:password])
    sign_in :user, resource
    return render nothing: true
  end

  invalid_login_attempt
end

This always returns 401 Unauthorized. I check the result of calling valid_password? and it is always false.

However, if I replace find_for_database_authentication with find_by, the valid_password? works with no problems. Why is this? It's okay if for now the user can only enter his email and not his password, but this really confuses me. It also bugs me that this doesn't use any token checking (different issue).

On the side, I'm also wondering about whether or not CSRF tokens are okay for internal APIs (should I use a different token-auth?), and how I'm supposed to include a CSRF token with a login form if the user isn't logged in yet, but I guess those are questions for another post. Thanks for any help.