<p><strong>UPDATE and final answer</strong>: The culprit was having the general config setting <code>validateUnsafeRequestParams =&gt; true</code> and not having my redirect value hashed (<code>{{ 'account/profile' | hash }}</code>). I had completely forgotten I had that setting turned on. Mijingo has a good explainer of how this setting works: <a href="https://mijingo.com/blog/hashing-redirect-params-in-craft" rel="nofollow noreferrer">https://mijingo.com/blog/hashing-redirect-params-in-craft</a></p>

<p>I'll still use the flash notice below for this particular case, but now I know what this error message comes from.</p>

<hr>

<p>My goal was that I was trying to redirect the form back to the same template, only with an appended parameter on the URL so I could write an update notice.</p>

<p>I never found out why I got the error, but ultimately it didn't matter as I found a better way of creating that notice through this answer <a href="https://craftcms.stackexchange.com/questions/15600/get-post-data-after-submitting-user-profile-form-for-success-message?rq=1">here</a>. Just by adding this to my template.</p>

<pre><code>{% if craft.session.getFlash('notice') == 'User saved.'|t %}
  &lt;p&gt;Success message!&lt;/p&gt;
{% endif %}
</code></pre>

CC BY-SA 3.0
2018-02-12T21:26:20.067Z
2018-02-13T14:51:48.400Z
2018-02-13T14:51:48.400Z
John Johnson
<p>I'm creating a user profile form on the front-end of our website. I've removed all template code and replaced it with the <a href="https://craftcms.com/docs/templating/user-profile-form" rel="nofollow noreferrer">documentation code</a> from the Craft website. I updated the docs code to reflect fields that we're using, rather than the example fields.</p>

<p>Upon clicking the Save Profile button, the next thing I get is this error:</p>

<pre><code>**Bad Request**

POST param “redirect” was invalid.
</code></pre>

<p>I've changed the redirect action input to multiple values, but none work.</p>

<p>I'm running Craft 2.6.3008.</p>

<p><strong>Update: Here's the form:</strong></p>

<pre><code>&lt;form method="post" accept-charset="UTF-8"&gt;
    {{ getCsrfInput() }}
    &lt;input type="hidden" name="action" value="users/saveUser"&gt;
    &lt;input type="hidden" name="redirect" value="account/profile?m=updated"&gt;
    &lt;input type="hidden" name="userId" value="{{ currentUser.id }}"&gt;

    &lt;label for="firstName"&gt;First Name&lt;/label&gt;
    &lt;input type="text" id="firstName" name="firstName" value="{{ currentUser.firstName }}"&gt;

    &lt;label for="lastName"&gt;Last Name&lt;/label&gt;
    &lt;input type="text" id="lastName" name="lastName" value="{{ currentUser.lastName }}"&gt;

    &lt;input type="submit" value="Save Profile"&gt;
&lt;/form&gt;
</code></pre>

<p>The form is located at account/profile. I'm asking it to return to the same template, just with a parameter appended to the address to verify the form was updated.</p>

CC BY-SA 3.0
2018-02-12T19:01:41.547Z
It might be a good idea to show us your form otherwise we can just guess what could be the issue.
Robin Schambach
CC BY-SA 3.0
2018-02-12T19:13:00.993Z
I've updated @RobinSchambach
John Johnson
CC BY-SA 3.0
2018-02-12T19:14:09.533Z
Did you define the corresponding route or is there an entry with this slug?
Robin Schambach
CC BY-SA 3.0
2018-02-12T20:11:45.860Z
Hmmm. So that redirect value needs to be an entry or a route? It can't just be a twig template? The form is on /account/profile and I want to redirect to the same template, just with a parameter appended to the address.
John Johnson
CC BY-SA 3.0
2018-02-12T20:27:48.927Z
Yes you can define a template as well, that is a valid route. I just wanted to ask if you inserted something completely different. About your error: it seems your security check in `SecurityManager` line 298 fails. I'm not 100% sure if parameters are allowed the way you are going to use it. I never tried such a thing like you and always used proper routing rules or proper post parameters to check if the form was submitted. Could you try to remove the parameter and tell me if it works then? If so I'll answer how to check if a form was submitted with twig or not
Robin Schambach
CC BY-SA 3.0
2018-02-12T20:32:35.457Z
It has the same error whether the redirect has the parameter or not. If I remove the redirect altogether, it works fine. What I wanted to do was use the parameter to show a success message. However, I've looked, and I can do the same with `craft.session.getFlash('notice')`, found here: https://craftcms.stackexchange.com/questions/15600/get-post-data-after-submitting-user-profile-form-for-success-message?rq=1

It looks like a much better solution, so I'll be using that going forward. However, the redirect still fails no matter what I have as its value.
John Johnson
CC BY-SA 3.0
2018-02-12T20:38:58.553Z
Yes that's usually the way to go. Would you mind answering your own question and mark it as accepted as soon as it's possible?
Robin Schambach
<user-profile><frontend-form>
Bad Request POST param “redirect” was invalid
# Bad Request POST param “redirect” was invalid

(Asked by: username_0 on 2018-02-12)

I'm creating a user profile form on the front-end of our website. I've removed all template code and replaced it with the documentation code from the Craft website. I updated the docs code to reflect fields that we're using, rather than the example fields.
Upon clicking the Save Profile button, the next thing I get is this error:
**Bad Request**

POST param “redirect” was invalid.

I've changed the redirect action input to multiple values, but none work.
I'm running Craft 2.6.3008.
Update: Here's the form:

    {{ getCsrfInput() }}
    
    
    

    First Name
    

    Last Name
    

    


The form is located at account/profile. I'm asking it to return to the same template, just with a parameter appended to the address to verify the form was updated.

**Tags:** user-profile, frontend-form
> **Comments:**
> **username_1**: It might be a good idea to show us your form otherwise we can just guess what could be the issue.  
> **username_0**: I've updated @RobinSchambach  
> **username_1**: Did you define the corresponding route or is there an entry with this slug?  
> **username_0**: Hmmm. So that redirect value needs to be an entry or a route? It can't just be a twig template? The form is on /account/profile and I want to redirect to the same template, just with a parameter appended to the address.  
> **username_1**: Yes you can define a template as well, that is a valid route. I just wanted to ask if you inserted something completely different. About your error: it seems your security check in `SecurityManager` line 298 fails. I'm not 100% sure if parameters are allowed the way you are going to use it. I never tried such a thing like you and always used proper routing rules or proper post parameters to check if the form was submitted. Could you try to remove the parameter and tell me if it works then? If so I'll answer how to check if a form was submitted with twig or not  
> **username_0**: It has the same error whether the redirect has the parameter or not. If I remove the redirect altogether, it works fine. What I wanted to do was use the parameter to show a success message. However, I've looked, and I can do the same with `craft.session.getFlash('notice')`, found here: https://craftcms.stackexchange.com/questions/15600/get-post-data-after-submitting-user-profile-form-for-success-message?rq=1  It looks like a much better solution, so I'll be using that going forward. However, the redirect still fails no matter what I have as its value.  
> **username_1**: Yes that's usually the way to go. Would you mind answering your own question and mark it as accepted as soon as it's possible?  

---

## 1 answers

### Answer by username_0 on 2018-02-12. Score: 3

UPDATE and final answer: The culprit was having the general config setting validateUnsafeRequestParams => true and not having my redirect value hashed ({{ 'account/profile' | hash }}). I had completely forgotten I had that setting turned on. Mijingo has a good explainer of how this setting works: https://mijingo.com/blog/hashing-redirect-params-in-craft
I'll still use the flash notice below for this particular case, but now I know what this error message comes from.

My goal was that I was trying to redirect the form back to the same template, only with an appended parameter on the URL so I could write an update notice.
I never found out why I got the error, but ultimately it didn't matter as I found a better way of creating that notice through this answer here. Just by adding this to my template.
{% if craft.session.getFlash('notice') == 'User saved.'|t %}
  Success message!
{% endif %}


---

