Implementing a secure confirmation page for an entity form (D8)

Question

I have a custom entity that is used for user submissions. Anonymous users will be able to submit confidential information using the entity add form. After submission I want to show some kind of confirmation page (Thank you for submitting etc.), but I'm not sure what is the best way to achieve this. The user should also receive a similar confirmation by email.

I was thinking of simply adding a view mode confirmation to the entity and have the form redirect to that page on submit, but I am concerned about access control here: visitors would be able to view other user's submissions, if they simply try random entity ids. Is there a way to restrict access to visitors who just submitted the form?

Answer 1

In drupal there are several way to do the same thing. What I suggest in this case (certainly different for another person) use a small custom module with Cookies or Session.

1. Create a custom module.

2. Add an extra submitter.

   • Save the new USER ID on session, cookie ...
   • Redirect to the page (Ex : $form_state->setRedirect('your.module.route.name');)

3. Create a small dynamic custom page (Like : http://www.drupal8.ovh/en/tutoriels/5/create-a-simple-module-for-drupal-8-step-2-create-simple-page)

   • Get the USER ID from session, cookie ...

You can change the confirmation mail template from back office.