I am experiencing a very weird issue. I have a simple user registration form:

<form method="post" action="" accept-charset="UTF-8" id="addTeacherForm">
    {{ csrfInput() }}

    <input type="hidden" name="action" value="users/save-user" />
    <input type="hidden" name="fields[schoolId][]" value="{{ currentUser.id }}" />
    <input type="hidden" name="groups[]" value="3" />

    <div class="form-group">
        <label for="username">Username <span class="text-danger">*</span></label>
        <input id="username" type="text" class="form-control" name="username" required />

    <div class="form-group">
         <label for="email">E-mailadres <span class="text-danger">*</span></label>
        <input id="email" type="text" class="form-control" name="email" required />

    <div class="form-group">
        <label for="password">Password <span class="text-danger">*</span></label>
        <input id="password" type="password" class="form-control" name="password" required />

    <div class="form-group">
        <button type="submit" class="btn btn-primary btn-submit float-right">
            Docent toevoegen

I have an event listener for the form submit and I submit the form using ajax. This code works perfectly most of the time, but sometimes (like 20% of the time) I get a 403 forbidden error in the console. When I comment out the hidden groups[] input field I don't experience this issue at all.

It is also worth noting that even though I get this error the user is created but doesn't get added to the group.

I'm starting to think this is a craft 3 issue.

Can I somehow solve this?


  • As noted in your answer below, this is related to a longstanding bug report. Closing as a "bug report". – Lindsey D Jun 26 '18 at 4:16

Can I somehow solve this?

Yes by creating a custom Controller. Because the default UsersController does the following

// Don't validate required custom fields if it's public registration
if (!$thisIsPublicRegistration) {

without SCENARIO_LIVE custom fields won't be stored

  • That's not the issue, my custom fields do get stored. The issue is that 20% of the time the user isn't getting assigned to the group and I get a 403 error. The other 80% of the time it works perfectly – Branko Jun 19 '18 at 13:04
  • Could you eventually tell me what the error message is exactly? You can take a look into your Yii dev Toolbar, in your logs or in your browser network tab. Maybe the user doesn't have the permission to assign to the group – Robin Schambach Jun 19 '18 at 13:06
  • thanks for the quick reply, I took a look at the toolbar and I see the following error: "This action can only be done by an administrator". I am the admin and have full permissions. Also, do you know why this only happens 20% of the time? – Branko Jun 19 '18 at 13:14
  • When you are dealing with registrations and storing users you'll likely get logged out and in as the other user. So chances are high you have a different account than you expect to have – Robin Schambach Jun 19 '18 at 13:16
  • I don't think that's what's happening because I have full access to the dashboard at all times even after creating the new user(s). I can't be logged in as the new user because the new user account is still set to pending. Thanks for your help though – Branko Jun 19 '18 at 13:21

I found out that this has been an issue since December 2017: github.com/craftcms/cms/issues/2194 .I hope they fix it soon. For now I'll go back to craft 2


Not the answer you're looking for? Browse other questions tagged or ask your own question.