How do I prevent form caching? I have a form using AJAX that will be used by many users at once, authenticated and anonymous users as well.

What precautions should I take to prevent data leaking between users (especially anonymous)?

I disabled the cache on route level via no_cache option. Is that sufficient or should I use \Drupal\Core\Form\FormStateInterface::disableCache() or maybe something else as well?
What precautions should I take to prevent data leaking between users (especially anonymous)?


You shouldn't have to do anything special. not even disable render cache.

Form data is only cached after the first ajax request and then it is for the specific form build Id (which is unique) only. That means that while the form is generated and cached in the page cache, the first request for every request for every user will rebuild the form from scratch.

There used to be a bug in core at some point in 8.x (long before 8.0) where the new user entity including its UUID was cached on the register form and then only one user could register every 6h because the others had UUID conflicts. The form cache changes fixed this.