I'm creating a user profile form on the front-end of our website. I've removed all template code and replaced it with the documentation code from the Craft website. I updated the docs code to reflect fields that we're using, rather than the example fields.

Upon clicking the Save Profile button, the next thing I get is this error:

**Bad Request**

POST param “redirect” was invalid.

I've changed the redirect action input to multiple values, but none work.

I'm running Craft 2.6.3008.

Update: Here's the form:

<form method="post" accept-charset="UTF-8">
    {{ getCsrfInput() }}
    <input type="hidden" name="action" value="users/saveUser">
    <input type="hidden" name="redirect" value="account/profile?m=updated">
    <input type="hidden" name="userId" value="{{ currentUser.id }}">

    <label for="firstName">First Name</label>
    <input type="text" id="firstName" name="firstName" value="{{ currentUser.firstName }}">

    <label for="lastName">Last Name</label>
    <input type="text" id="lastName" name="lastName" value="{{ currentUser.lastName }}">

    <input type="submit" value="Save Profile">

The form is located at account/profile. I'm asking it to return to the same template, just with a parameter appended to the address to verify the form was updated.

  • It might be a good idea to show us your form otherwise we can just guess what could be the issue. Feb 12 '18 at 19:01
  • I've updated @RobinSchambach Feb 12 '18 at 19:13
  • Did you define the corresponding route or is there an entry with this slug? Feb 12 '18 at 19:14
  • Hmmm. So that redirect value needs to be an entry or a route? It can't just be a twig template? The form is on /account/profile and I want to redirect to the same template, just with a parameter appended to the address. Feb 12 '18 at 20:11
  • Yes you can define a template as well, that is a valid route. I just wanted to ask if you inserted something completely different. About your error: it seems your security check in SecurityManager line 298 fails. I'm not 100% sure if parameters are allowed the way you are going to use it. I never tried such a thing like you and always used proper routing rules or proper post parameters to check if the form was submitted. Could you try to remove the parameter and tell me if it works then? If so I'll answer how to check if a form was submitted with twig or not Feb 12 '18 at 20:27

UPDATE and final answer: The culprit was having the general config setting validateUnsafeRequestParams => true and not having my redirect value hashed ({{ 'account/profile' | hash }}). I had completely forgotten I had that setting turned on. Mijingo has a good explainer of how this setting works: https://mijingo.com/blog/hashing-redirect-params-in-craft

I'll still use the flash notice below for this particular case, but now I know what this error message comes from.

My goal was that I was trying to redirect the form back to the same template, only with an appended parameter on the URL so I could write an update notice.

I never found out why I got the error, but ultimately it didn't matter as I found a better way of creating that notice through this answer here. Just by adding this to my template.

{% if craft.session.getFlash('notice') == 'User saved.'|t %}
  <p>Success message!</p>
{% endif %}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.