Create new users with front end form and put them in a group, need help with start-elevated-session This has been a long process that I set aside to resolve "later". Well, it's "later" and the clients wants to launch asap.

Only registered users can use this site. There are 2 groups: Manager and Employee. Users in Manager group have permission to create new users and put them in Employee group. It all works in the back end.

Using the craft front end User Registration template I added a hidden field for the group id &lt;input type="hidden" name="groups[]" value="2"&gt; and when I submit I get "HTTP 403 – Forbidden, This action may only be performed with an elevated session."

Some googling lead me to this craftcms github comment. I get what it's saying about the elevated session and needing to send the password again but am having issues doing it. First step is testing with hard coded values on my form submit:

$.ajax({
    method: 'POST',
    url: 'https://www.myurl.ca/',
    data: { action: 'users/start-elevated-session', password: 'xxx'}
})
.done(function( msg ) {
    alert( "Data: " + msg );
});


But nothing is alerted. So something is failing. 

When I try https://www.myurl.ca/?action=users/start-elevated-session&amp;password=xxx in a new browser tab I get "TypeError, Argument 1 passed to craft\web\User::startElevatedSession() must be of the type string, null given, called in /.../vendor/craftcms/cms/src/controllers/UsersController.php on line 234".

So it can't find password value. It's just getting null. I feel like maybe I don't know what "body params" means in the github comment. Can someone explain it like I'm 5?

Thanks
Amanda
Elevated sessions are basically user sessions where the user has proven to Craft that it’s really them within the last 5 minutes. It’s used whenever Craft is about to increase permissions on a user (either directly or via a user group).

The point of the concept is to reduce the chances of malicious permission escalation.

(In English, that means if a user with certain permissions/groups walks away from their computer, elevated sessions reduces the likelihood that another user could walk up to it, find their own user account, and increase their account permissions. They’d think they’re going to get away with it right up until the point where Craft asks them to re-enter their password, which kicks off the elevated session.)

I’m explaining this so that you understand the risk in what I’m about to say.

Maybe the easiest way for you to work around this issue is to just disable elevated sessions on your site. You can do that by opening config/general.php and adding this:

return [
    'elevatedSessionDuration' =&gt; 0,
    // ...
];


If you do that, Craft will no longer require elevated sessions anywhere.

Otherwise, you need to have the user enter their current password as part of the user form, and send that off to Craft’s users/start-elevated-session action.

You can get that action URL, and the CSRF token needed to make any POST requests to Craft, and send them to JavaScript like this:

&lt;script&gt;
    window.startElevatedSessionUrl = "{{ actionUrl('users/start-elevated-session')|e('js')|raw }}";
    window.csrfTokenValue = "{{ craft.app.request.csrfToken|e('js')|raw }}";
&lt;/script&gt;


Then in JavaScript (assuming you’re using jQuery),

$.ajax({
    url: window.startElevatedSessionUrl, {
    type: 'POST',
    dataType: 'json',
    headers: {
        'X-CSRF-Token': window.csrfTokenValue
    },
    data: {
        password: $('#current-password-input').val()
    },
    success: function(response, textStatus) {
        // submit the user form...
    }),
    error: function(jqXHR, textStatus) {
        // error handling...
    })
});


If you want to get even fancier you can check to make sure the user doesn’t already have an elevated session by running a POST request to users/get-elevated-session-timeout. If response.timeout is greater than 5 (seconds) or so, then it’s safe to submit the form without prompting them for their current password.