[PKG-Openstack-devel] Bug#862387: openstack-dashboard: instance delete fails with: 403 Forbidden - CSRF verification failed. Request aborted.

[Valentin Vidic]

Package: openstack-dashboard
Version: 3:10.0.1-1
Severity: normal

Dear Maintainer,

Instance delete fails when I access:

  http://os-ctrl/horizon/project/instances/

and select "Delete Instance" from the list of actions with
the error:

  Forbidden (403)
  CSRF verification failed. Request aborted.

  Help
  Reason given for failure:
    CSRF token missing or incorrect.

while I see the csrftoken being sent in the request:

  csrftoken: tMhcr99nId798AXdULs8dUjuEHemALp0ONGCa4Y8ahpIuckFFqxexCuD13uR5ATy
        
Apache error.log just reports the same thing:

  Forbidden (CSRF token missing or incorrect.): /horizon/project/instances/, referer: http://os-ctrl/horizon/project/instances/

Deleting the instance works if I enter the instance first:

  http://os-ctrl/horizon/project/instances/6a167f8a-f0c6-440a-a1c1-c0063058d5c4/

and than select "Delete Instance" from the list of actions.

The same issue exists when deleting volumes from:

  http://os-ctrl/horizon/project/volumes/


-- System Information:
Debian Release: 9.0
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64
 (x86_64)

Kernel: Linux 4.9.0-2-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages openstack-dashboard depends on:
ii  adduser                3.115
ii  libjs-jquery           3.1.1-2
ii  libjs-jquery-cookie    11-3
ii  python-django-horizon  3:10.0.1-1
pn  python:any             <none>

openstack-dashboard recommends no packages.

Versions of packages openstack-dashboard suggests:
ii  memcached                   1.4.33-1
ii  openstack-dashboard-apache  3:10.0.1-1

-- no debconf information