The Users & Permissions plugin's register.allowedFields configuration option defaults to []

In Strapi 5, the Users & Permissions plugin's register.allowedFields configuration option defaults to [].

This page is part of the breaking changes database and provides information about the breaking change and additional instructions to migrate from Strapi v4 to Strapi 5.

🔌 Is this breaking change affecting plugins?	No

🤖 Is this breaking change automatically handled by a codemod?	Yes

Breaking change description

In Strapi v4

Any new fields added to the User content type would be accepted by the registration form by default, and Strapi would warn about each field on startup.

The users have the option to set users-permissions.register.allowedFields in the config/plugins.js file to an array of the fields they wanted to accept on their registration endpoint. For example, [’picture’] to accept a picture attribute on registration. Or an empty array [] if they do not want to accept anything else.

However, if users did not set any value, that is, when allowedFields is undefined, all user fields are accepted.

In Strapi 5

An undefined allowedFields is treated as an empty array, and no fields are accepted by default. Users must explicitly choose to allow extra fields on registration.

Migration

This section regroups useful notes and procedures about the introduced breaking change.

Manual procedure

A codemod should handle this migration. If not, please refer to the documentation on how to register allowed fields for the Users & Permissions plugin.