<p><code>UsersController::actionStartElevatedSession()</code> is <a href="https://github.com/craftcms/cms/blob/develop/src/controllers/UsersController.php#L231" rel="nofollow noreferrer">public</a> so you can access it via frontend form but you should only call it via ajax request.</p>

<p>You can just submit your normal user form via ajax and if it contains an error with key <code>currentPassword</code> you can be sure to require a elevated session and display a password form to enter it in order to create a request to the route above. This will start the session and you can submit the user form a second time. </p>

<p>So in summary: you don't need a custom controller at all. You can change the user's email and password by submitting a form with <code>newPassword</code> and <code>email</code> but you'll receive the error <code>Incorrect current password</code> if there is no elevated session or if the password parameter doesn't match the user's old password (you always need to submit it together). </p>

<p>If you want additional security you can send the <code>sendVerificationEmail</code> to force users to verify their email by sending them a mail. But keep in mind all those things can be manipulated via frontend request. Users are totally free to change the html of your form</p>

CC BY-SA 4.0
2018-10-11T18:51:10.690Z
Thanks. Much easier than I thought. Haven't had a chance to implement, but this should put me on the right track. Cheers.
Douglas McDonald
CC BY-SA 4.0
2018-10-06T18:53:29.560Z
2018-10-06T19:06:17.473Z
2018-10-06T19:06:17.473Z
Robin Schambach
<p>Is there a way to allow users to edit their email address via a front-end form in Craft 3?</p>

<p>My understanding is this would require an 'elevated' user session. Which I'm guessing can only be achieved via plugin. In the API docs I see that there is a <a href="https://docs.craftcms.com/api/v3/craft-web-user.html#method-startelevatedsession" rel="nofollow noreferrer">startElevatedSession()</a> method.</p>

<p>At a minimum, I'm assuming this might work:</p>

<ul>
<li>Submit form with existing password and new email to a custom controller. </li>
<li>Controller starts an elevated session via <code>startElevatedSession()</code>, sets new password on user, saves user, and redirects to success page.</li>
</ul>

<p>If I were to create a 'confirm email' workflow for security — how might that work? Can I tap into the Craft native workflow? Or would it all need to be custom?</p>

<p>FYI... in this case, the site is set to <code>useEmailAsUsername</code> if that makes a difference.</p>

<p>As a follow-up, would changing the email address affect relationships to commerce orders? I assume that they are related by something other than just email address.</p>

<p>Any general pointers would be much appreciated. Thanks.</p>

<plugin-development><craft3><users>
Allow users to edit user account email from front end form in Craft 3?
# Allow users to edit user account email from front end form in Craft 3?

(Asked by: username_0 on 2018-10-06)

Is there a way to allow users to edit their email address via a front-end form in Craft 3?

My understanding is this would require an 'elevated' user session. Which I'm guessing can only be achieved via plugin. In the API docs I see that there is a [startElevatedSession()](https://docs.craftcms.com/api/v3/craft-web-user.html#method-startelevatedsession) method.

At a minimum, I'm assuming this might work:

* Submit form with existing password and new email to a custom controller.
* Controller starts an elevated session via `startElevatedSession()`, sets new password on user, saves user, and redirects to success page.

If I were to create a 'confirm email' workflow for security — how might that work? Can I tap into the Craft native workflow? Or would it all need to be custom?

FYI... in this case, the site is set to `useEmailAsUsername` if that makes a difference.

As a follow-up, would changing the email address affect relationships to commerce orders? I assume that they are related by something other than just email address.

Any general pointers would be much appreciated. Thanks.

**Tags:** plugin-development, craft3, users

---

## 1 answers

### Answer by username_1 on 2018-10-06. Score: 2 | Accepted answer

`UsersController::actionStartElevatedSession()` is [public](https://github.com/craftcms/cms/blob/develop/src/controllers/UsersController.php#L231) so you can access it via frontend form but you should only call it via ajax request.

You can just submit your normal user form via ajax and if it contains an error with key `currentPassword` you can be sure to require a elevated session and display a password form to enter it in order to create a request to the route above. This will start the session and you can submit the user form a second time.

So in summary: you don't need a custom controller at all. You can change the user's email and password by submitting a form with `newPassword` and `email` but you'll receive the error `Incorrect current password` if there is no elevated session or if the password parameter doesn't match the user's old password (you always need to submit it together).

If you want additional security you can send the `sendVerificationEmail` to force users to verify their email by sending them a mail. But keep in mind all those things can be manipulated via frontend request. Users are totally free to change the html of your form

> **Comments:**
> **username_0**: Thanks. Much easier than I thought. Haven't had a chance to implement, but this should put me on the right track. Cheers.  

---

