[openstack-dev] [Horizon] Cookie collision between Horizon & Stacktach

Aaron Sahlin asahlin at linux.vnet.ibm.com
Fri Oct 31 19:36:42 UTC 2014


I was posed this question, but am not familiar with Horizon or StackTach 
cookie management.      Anyone know what the issue might be?

Issue: Logging into one site logs you out of the other. (horizon/stacktach)

First I open horizon and notice there are two cookies: csrftoken 
(horizon) and sessionid. I log into Horizon, then open up a new tab and 
log into stacktach (same domain, different port). After logging into 
stacktach, there's another cookie created named 
beaker.session.stacktach.  I go back to the horizon dashboard and get 
logged off after clicking anything. After trying to log back in, this 
error comes up: "Your Web browser doesn't appear to have cookies 
enabled. Cookies are required for logging in." I then clear the cookies 
and am able to log in, but see this error message: "Forbidden (403) CSRF 
verification failed. Request aborted." I go back to the Horizon log in 
page, finally log in, go to stacktach tab and am logged out of that.

Note that stacktach is at a separate port on the controller and uses 
beaker to create the cookie session. I've read that cookies aren't 
port-speciic on the same domain name, but should still work with 
different cookie names.. I've also tried changing the paths on the 
stacktach urls, but no luck there either.




More information about the OpenStack-dev mailing list