We have a Drupal 9.5.8 instance running webforms (server 1), this is the instance we used for creating and managing our webforms. We have another Drupal instance on another server running Drupal 9.5.8 which is our regular full website (server 2). We use the webforms_share module to include the webforms created on server 1 to server 2. On server 2 we display the embedded webform through a block and including the block on a page.
We have recently noticed that if the webform status is set to closed on server 1, the shared form will still be open and able to be submitted from server 2 if the account on server 2 has authenticated but has since logged out. If we clear the browser cookies the webform will appear closed as expected.
I'm having trouble figuring out exactly where the issue is happening other than to understand it seems isolated to cookies and shared forms. Any help tracking this down would be very helpful! In the meantime we remove the blocks from the page to work around this issue.
Closed: works as designed
6.2
Code
Ok, so more testing reveals this totally makes sense.
When logged into server 1 the shared closed form form will still display and be accessible.
Logout of server 1 and the closed form message appears and the form is no longer accessible.
I wasn't keep track of where I had access, but the cookies were.