Implementing a secure confirmation page for an entity form (D8) I have a custom entity that is used for user submissions. Anonymous users will be able to submit confidential information using the entity add form. After submission I want to show some kind of confirmation page (Thank you for submitting etc.), but I'm not sure what is the best way to achieve this. The user should also receive a similar confirmation by email.

I was thinking of simply adding a view mode confirmation to the entity and have the form redirect to that page on submit, but I am concerned about access control here: visitors would be able to view other user's submissions, if they simply try random entity ids. Is there a way to restrict access to visitors who just submitted the form?
In drupal there are several way to do the same thing.
What I suggest in this case (certainly different for another person) use a small custom module with Cookies or Session.


Create a custom module.
Add an extra submitter.


Save the new USER ID on session, cookie ...
Redirect to the page (Ex : $form_state-&gt;setRedirect('your.module.route.name');)

Create a small dynamic custom page (Like : http://www.drupal8.ovh/en/tutoriels/5/create-a-simple-module-for-drupal-8-step-2-create-simple-page)


Get the USER ID from session, cookie ...



You can change the confirmation mail template from back office.