# FormHelper hiddenfield double POSTed

**URL:** <https://discourse.cakephp.org/t/formhelper-hiddenfield-double-posted/12407>\
**Category:** Need Help\
**Created:** [February 4, 2025, 4:38pm UTC](https://discourse.cakephp.org/t/formhelper-hiddenfield-double-posted/12407 "2025-02-04T16:38:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![der-dave](https://avatars.discourse-cdn.com/v4/letter/d/e47774/32.png) [@der-dave](https://discourse.cakephp.org/u/der-dave)\
**Post date:** [February 4, 2025, 4:38pm UTC](https://discourse.cakephp.org/t/formhelper-hiddenfield-double-posted/12407/1 "2025-02-04T16:38:57Z")

</div>

Hello all!

Since yesterday I have a weird problem I absolutely cannot understand anymore (after updateing CakePHP to latest version from previous V5.1.xx).

A Checkbox in my form (with the automatically added hiddenfield) ist POSTed two times so the `FormProtectionComponent` is failing.

For example:  
Simple login form with email, password and remember\_me checkbox:  
When analyzing the request I can see that the `remember_me` field is send two times with value `0` and `1`

Was there anything changed in handling of radios and checkboxes and their hidden fields?  
I am sure it must be something in genaral because on every form I have this error. And when disabling `FormProtectionComponent` everything works fine.

Thank you for your help 🙂

---

<div class="post-metadata">

**Author:** ![Rods](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@Rods](https://discourse.cakephp.org/u/Rods)\
**Post date:** [February 5, 2025, 12:23am UTC](https://discourse.cakephp.org/t/formhelper-hiddenfield-double-posted/12407/2 "2025-02-05T00:23:59Z")

</div>

try this

\<?=$this-\>Form-\>checkbox('remember\_me', ['hiddenField' =\> false,])?\>

---

<div class="post-metadata">

**Author:** ![der-dave](https://avatars.discourse-cdn.com/v4/letter/d/e47774/32.png) [@der-dave](https://discourse.cakephp.org/u/der-dave)\
**Post date:** [February 5, 2025, 3:43pm UTC](https://discourse.cakephp.org/t/formhelper-hiddenfield-double-posted/12407/3 "2025-02-05T15:43:23Z")

</div>

Thank you Rods, thats something I tried earlier.  
I found out that this isnt the problem.

My problem is, that after sending my form everytime the `FormProtectionComponent` fails with validation. And I am getting a `Cake\Http\Exception\BadRequestException` error.

When diabling `FormProtectionComponent` everything works fine, but without protection. Any ideas why this could happen or what I can do? Thank you 🙂  
This happens to every form on my website.

**After some test I tried now to access my page local via HTTPS and its working. But why?**