I've got a form that redirects to a results page on submission. Results page currently lives at /form/results/[submission.id]/success/

The results page shows the user's answers, and a bunch of other results.

Is there a 'best' way to make it so that this results page is only accessible for the current user/session? I don't want to have it be available for any random joe to just try IDs and see someone else's results.

1 Answer 1


The short answer is that freeform doesn't do it.

The longer answer is that you can cheat with a cookie.

I used a cookie. Used this plugin: https://github.com/nystudio107/cookies

In Freeform's admin, I created a hidden field called "cookie validator" and added it to my form.

On the page that my form lives on /form/, I added a cookie that sets a value of a large random number.

{% set randomNumber = random(9999999999) %}
{{ setCookie('formcookie', randomNumber, now | date_modify("+1 hour").timestamp ) }}

{{ form.render }}

{% set cookievalueJS %}
  $(document).ready(function() {
    $('#form-input-cookievalidator').val("{{ randomNumber }}");
{% endset %}
{% includeJs cookievalueJS %}

This creates a random number first. Then sets a cookie with that number as a value. And then sets the input field to have that same number.

Then, on my form results page /form/results/

Instead of using an 'isSuccess' check, I check for the cookie & field value...

{% set submissionId = segment2 %}
{% set form = craft.freeform.form('myForm') %}
{% set submission = craft.freeform.submissions({
    id: submissionId,
    form: formHandle,
}).first() %}

{% if myCookie  ==  submission.cookievalidator %}
  {# render all the submission data here #}
{% else %}
  {# show the "nothing to show here" page #}
{% endif %}

NOTE: I'm going to move this to an all https site eventually, and will probably have to swap the cookie to be a securecookie. But that's pretty straightforward with the cookie plugin.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.