Is there a way to allow users to edit their email address via a front-end form in Craft 3?

My understanding is this would require an 'elevated' user session. Which I'm guessing can only be achieved via plugin. In the API docs I see that there is a startElevatedSession() method.

At a minimum, I'm assuming this might work:

  • Submit form with existing password and new email to a custom controller.
  • Controller starts an elevated session via startElevatedSession(), sets new password on user, saves user, and redirects to success page.

If I were to create a 'confirm email' workflow for security — how might that work? Can I tap into the Craft native workflow? Or would it all need to be custom?

FYI... in this case, the site is set to useEmailAsUsername if that makes a difference.

As a follow-up, would changing the email address affect relationships to commerce orders? I assume that they are related by something other than just email address.

Any general pointers would be much appreciated. Thanks.

1 Answer 1


UsersController::actionStartElevatedSession() is public so you can access it via frontend form but you should only call it via ajax request.

You can just submit your normal user form via ajax and if it contains an error with key currentPassword you can be sure to require a elevated session and display a password form to enter it in order to create a request to the route above. This will start the session and you can submit the user form a second time.

So in summary: you don't need a custom controller at all. You can change the user's email and password by submitting a form with newPassword and email but you'll receive the error Incorrect current password if there is no elevated session or if the password parameter doesn't match the user's old password (you always need to submit it together).

If you want additional security you can send the sendVerificationEmail to force users to verify their email by sending them a mail. But keep in mind all those things can be manipulated via frontend request. Users are totally free to change the html of your form

  • Thanks. Much easier than I thought. Haven't had a chance to implement, but this should put me on the right track. Cheers. Commented Oct 11, 2018 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.