I am experiencing a very weird issue. I have a simple user registration form:

<form method="post" action="" accept-charset="UTF-8" id="addTeacherForm">
    {{ csrfInput() }}

    <input type="hidden" name="action" value="users/save-user" />
    <input type="hidden" name="fields[schoolId][]" value="{{ currentUser.id }}" />
    <input type="hidden" name="groups[]" value="3" />

    <div class="form-group">
        <label for="username">Username <span class="text-danger">*</span></label>
        <input id="username" type="text" class="form-control" name="username" required />

    <div class="form-group">
         <label for="email">E-mailadres <span class="text-danger">*</span></label>
        <input id="email" type="text" class="form-control" name="email" required />

    <div class="form-group">
        <label for="password">Password <span class="text-danger">*</span></label>
        <input id="password" type="password" class="form-control" name="password" required />

    <div class="form-group">
        <button type="submit" class="btn btn-primary btn-submit float-right">
            Docent toevoegen

I have an event listener for the form submit and I submit the form using ajax. This code works perfectly most of the time, but sometimes (like 20% of the time) I get a 403 forbidden error in the console. When I comment out the hidden groups[] input field I don't experience this issue at all.

It is also worth noting that even though I get this error the user is created but doesn't get added to the group.

I'm starting to think this is a craft 3 issue.

Can I somehow solve this?


closed as off-topic by Lindsey D Jun 26 '18 at 4:16

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Bug reports are off-topic because they are unlikely to help others and can’t easily be found by those who can fix them. Instead, submit them directly to the vendor, or the product’s public issue tracker (i.e. submit Craft CMS bug reports to github.com/craftcms/cms/issues)." – Lindsey D
If this question can be reworded to fit the rules in the help center, please edit the question.

  • As noted in your answer below, this is related to a longstanding bug report. Closing as a "bug report". – Lindsey D Jun 26 '18 at 4:16

Can I somehow solve this?

Yes by creating a custom Controller. Because the default UsersController does the following

// Don't validate required custom fields if it's public registration
if (!$thisIsPublicRegistration) {

without SCENARIO_LIVE custom fields won't be stored

  • That's not the issue, my custom fields do get stored. The issue is that 20% of the time the user isn't getting assigned to the group and I get a 403 error. The other 80% of the time it works perfectly – Branko Jun 19 '18 at 13:04
  • Could you eventually tell me what the error message is exactly? You can take a look into your Yii dev Toolbar, in your logs or in your browser network tab. Maybe the user doesn't have the permission to assign to the group – Robin Schambach Jun 19 '18 at 13:06
  • thanks for the quick reply, I took a look at the toolbar and I see the following error: "This action can only be done by an administrator". I am the admin and have full permissions. Also, do you know why this only happens 20% of the time? – Branko Jun 19 '18 at 13:14
  • When you are dealing with registrations and storing users you'll likely get logged out and in as the other user. So chances are high you have a different account than you expect to have – Robin Schambach Jun 19 '18 at 13:16
  • I don't think that's what's happening because I have full access to the dashboard at all times even after creating the new user(s). I can't be logged in as the new user because the new user account is still set to pending. Thanks for your help though – Branko Jun 19 '18 at 13:21

I found out that this has been an issue since December 2017: github.com/craftcms/cms/issues/2194 .I hope they fix it soon. For now I'll go back to craft 2

Not the answer you're looking for? Browse other questions tagged or ask your own question.