[openstack-dev] [Horizon] Cookie collision between Horizon & Stacktach
Aaron Sahlin
asahlin at linux.vnet.ibm.com
Fri Oct 31 19:36:42 UTC 2014
I was posed this question, but am not familiar with Horizon or StackTach
cookie management. Anyone know what the issue might be?
Issue: Logging into one site logs you out of the other. (horizon/stacktach)
First I open horizon and notice there are two cookies: csrftoken
(horizon) and sessionid. I log into Horizon, then open up a new tab and
log into stacktach (same domain, different port). After logging into
stacktach, there's another cookie created named
beaker.session.stacktach. I go back to the horizon dashboard and get
logged off after clicking anything. After trying to log back in, this
error comes up: "Your Web browser doesn't appear to have cookies
enabled. Cookies are required for logging in." I then clear the cookies
and am able to log in, but see this error message: "Forbidden (403) CSRF
verification failed. Request aborted." I go back to the Horizon log in
page, finally log in, go to stacktach tab and am logged out of that.
Note that stacktach is at a separate port on the controller and uses
beaker to create the cookie session. I've read that cookies aren't
port-speciic on the same domain name, but should still work with
different cookie names.. I've also tried changing the paths on the
stacktach urls, but no luck there either.
More information about the OpenStack-dev
mailing list