I have a custom entity that is used for user submissions. Anonymous users will be able to submit confidential information using the entity add form. After submission I want to show some kind of confirmation page (Thank you for submitting etc.), but I'm not sure what is the best way to achieve this. The user should also receive a similar confirmation by email.
I was thinking of simply adding a view mode
confirmation to the entity and have the form redirect to that page on submit, but I am concerned about access control here: visitors would be able to view other user's submissions, if they simply try random entity ids. Is there a way to restrict access to visitors who just submitted the form?