Form build caching is broken in Drupal 11

Which Drupal Core commit caused this? It could be #3538294: Regression: All stack middlewares are constructed at the same time even for cached pages or something else.

This feels like a critical and stable release blocking issue

The tests that have a status of failed did not fail because of my changes. As I can see, these tests are also failing on other MRs.

Tests are passing. I am going to commit this.

@jrockowitz Hi, it is really great that this D11 stable major blocker was merged, but I was not sure if the test for anonymous users actually covers the expected behavior, do you know?

https://git.drupalcode.org/project/webform/-/merge_requests/764#note_619905

I don’t know if test coverage was checking this issue. Should we reopen this ticket?

I looked into exactly why this broke in D11. It is due to the change introduced in #2578855: Form tokens are now rendered lazily, allow forms to opt in to be cacheable as suggested in #4. Prior to that change, Drupal's FormBuilder added a CSRF token to all forms for authenticated users and added a cache max-age=0 to it, which bubbled up and prevented Dynamic Page Cache from caching the form.

This is where it gets complicated. After the core change, Drupal only adds this max-age of 0 on the form token if the form array didn't already have any max-age set. Additionally, core sets a max-age=0 to all entity forms. So why is this closed form message (for the user that already submitted the form) being cached by Dynamic Page Cache still?

This happens because WebformSubmissionForm::form() has this code:

    ...
    // Check for a custom webform, track it, and return it.
    if ($custom_form = $this->getCustomForm($form, $form_state)) {
      $custom_form['#custom_form'] = TRUE;
      return $custom_form;
    }

    $form = parent::form($form, $form_state);
    ...

A "custom form" (the form closed message) is returned immediately and the parent form method is never invoked (which is where core would force max-age=0 on the form array as it does for all entity forms). Later, when core goes to add the CSRF token to the form, it also doesn't set max-age=0 on it because the form already has max-age=-1 set (this is due to webform adding the Webform entity as a cacheable dependency to the form array and all config entities have a max-age=-1).

In other words, the core change introduced in D11 suddenly started making cacheable the submission forms that don't return the normal form (e.g., they display a closed message instead of the form elements). This wouldn't normally be a problem if the proper cache contexts were also set on the form, but Webform was missing them.

The fix committed in this issue does address the problem presented by adding cache contexts for the user (note there may be other cache contexts missing, that's not clear yet) to the form, but it doesn't do it completely right. It's only adding the needed cache contexts for webform submission forms loaded via the WebformEntityController::addForm method. Forms shown via a block don't use this code path. So the fix should be implemented instead in the WebformSubmissionForm class instead.

Since this issue was marked closed as fixed, I'll create a follow up for it.

Follow up #3561066: Set max-age:0 for authenticated users to exclude Webforms from Dynamic page cache created

This was committed in 3f9db01.