Horizon sessions live on after keystone token expires

[Andrew Bogott]

If I'm in the process of using Horizon and my keystone token expires, Horizon keeps on 'working.' Anything that involves an API call fails, and I get an error notice about the failure, but the frames keep loading and display a patchwork of information (depending on what may be cached and what does and doesn't require an API call.) I can reproduce this issue by deleting my token from the keystone database if I don't feel like waiting.

After some unpredictable amount of time, I'm kicked back to the login screen.

I would expect the prompt to re-login to happen immediately, as soon as my token expires. Indeed, I'm pretty sure this was the behavior back in Ocata.

I'm running Horizon version 'train' with UUID tokens and backend APIs of version 'Pike,' using django.core.cache.backends.memcached.MemcachedCache.

[Akihiro Motoki (amotoki)]

I have a couple of questions.

- In which panels does this issue happen? There are two types of implementations of panels in horizon, so I would like to know panels where it happens. It would be nice if examples cover both AngularJS and Django-based panels.
- Is it specific to UUID token? UUID token support was removed in Rocky release, so horizon train is not tested apparently with UUID token. In case of fernet token, we have a known topic reported in bug 1861224.
- Does it happen in Horizon Pike? If it happens only in horizon train, commit ab0e96df9506fb6f1783e0ee79b63934dabe0cbe might affect it.
- Does it happen in train deployments? I would like to clarify this happens when pike deployments with horizon train.

P.S.
As my hat of the upstream development team, it is not easy to reproduce this as we need to prepare Pike environments with horizon train. If it is specific to UUID token with horizon train or it is specific to combination of pike deployment and train horizon, it would be a case where a deployer needs to take a risk and identify what happens.

[Akihiro Motoki (amotoki)]

I mark this as Incomplete temporarily as it is not clear whether this happens only for mixed releases (pike and train). Horizon officially supports backends with a same release and mixing releases should be cared by deployers if they want.

[Launchpad Janitor (janitor)]

[Expired for OpenStack Dashboard (Horizon) because there has been no activity for 60 days.]