I don't want users to be able to edit their webform submissions after they have been submitted (in this case it's an application form that needs to be reviewed).

The trouble is, they also need to be able to partially complete and return to it. If they've saved a draft, to continue, they have to access:


and with 'Update own webform submissions' disallowed (which you can do per webform, remember) that route is blocked.

I can't see anything obvious in the options for drafts (Settings > Submissions) yet I can't be the first person to have needed this…

Solution I've come up with so far:

  • enabling edit/update access for all users
  • adding a RouteSubscriber for entity.webform.user.submission.edit
  • loading the submission there, using ->isDraft() to check its status
  • denying access for false, depending on role/ownership

Any better ideas?

(NB: this doesn't involve anonymous users - they have to be registered and logged in.)

1 Answer 1


You don't need a custom route, you can hook into the entity access check for the existing entity routes:


use Drupal\Core\Session\AccountInterface;
use Drupal\Core\Access\AccessResult;
use Drupal\webform\WebformSubmissionInterface;

 * Implements hook_ENTITY_TYPE_access().
function mymodule_webform_submission_access(WebformSubmissionInterface $webform_submission, $op, AccountInterface $account) {
  if ($op == 'edit' && !$webform_submission->isDraft() && in_array('role', $account->getRoles())) {
    return AccessResult::forbidden()->cachePerPermissions();
  return AccessResult::neutral()->cachePerPermissions();
  • sorry… weirdly, just viewing the submission triggers three separate operations: "view", then "update", then "delete" (have verified with logger after removing the rest of that function, and also tested on a separate, simpler form). Any ideas? (Noticed when attempting to use messenger()->addError() to display a message on failure, which was also being triggered by the rogue 'update' on ordinary view…) If not I'll open an issue… Commented Jul 22, 2018 at 19:49
  • 1
    Then you have on the view page links for updating and deleting the webform submission. Just focus on the operation you want to change the access for.
    – 4uk4
    Commented Jul 22, 2018 at 20:10
  • ... and then not only the access is denied, but also the links to the denied page will disappear.
    – 4uk4
    Commented Jul 23, 2018 at 6:27
  • Thanks, understood now. (For various reasons, I still want a custom error message for the edit URL, so I've added a conditional to check the route name, which means the message is not shown, err, erroneously, when the 'Update' link is checked.) Commented Jul 23, 2018 at 8:53
  • Does it make sense to add the user.roles cache context rather than user.permissions as you check the role rather than a permission?
    – Andy
    Commented Jul 23, 2018 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.