Creating an issue from board fails with 422

Summary

When first loading our group board in the morning (pinned tab in chrome), I find it's not possible to create an issue directly on the board via the + button. The UI shows up, a title can be entered and project can be selected (ajax to https://gitlab.com/api/v4/groups/177005/projects.json?search=jobs&per_page=20&with_issues_enabled=true&with_shared=false&include_subgroups=true&min_access_level=20 works).

When you press "Submit Issue" the card disappears and I can see a POST https://gitlab.com/-/boards/564465/lists/1434666/issues 422 (Unprocessable Entity) in the browser console.

I've found this also happens occasionally throughout the day.

A refresh of the page seems to fix the issue. Feels like something session or csrf related to me.

Steps to reproduce

  1. Keep an issue board pinned in a tab and leave it for a while (happens to me every morning without fail so overnight is long enough, actual time required unknown).
  2. Click + on one of the lists to add a new issue.
  3. Enter a description and select a project (We only use the group board, haven't tried/tested project board).
  4. Click "Submit Issue".

Example Project

https://gitlab.com/groups/beehiive/-/boards?scope=all&utf8=%E2%9C%93&state=opened

What is the current bug behavior?

The card containing the form disappears and the issue is NOT created. Trying multiple times has the same outcome. Refreshing the page then retying fixes the issue.

What is the expected correct behavior?

The issue should be created and the card for the issue should appear on the board.

Relevant logs and/or screenshots

POST /-/boards/564465/lists/1434666/issues HTTP/1.1
Host: gitlab.com
Connection: keep-alive
Content-Length: 342
Accept: application/json, text/plain, */*
Origin: https://gitlab.com
X-CSRF-Token: Aa** ommited for security **pw==
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/78.0.3904.108 Chrome/78.0.3904.108 Safari/537.36
Content-Type: application/json;charset=UTF-8
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Referer: https://gitlab.com/groups/beehiive/-/boards?scope=all&utf8=%E2%9C%93&state=opened
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: _ga=GA** ommited for security **87; _gaexp=GA** ommited for security **8.1; _hjid=99** ommited for security **4b; _mkto_trk=id:194-VVC-221&token:_mch-gitlab.com-15** ommited for security **63; _biz_uid=5b** ommited for security **f1; _biz_flagsA=%7B%22Version%22%3A1%2C%22XDomain%22%3A%221%22%7D; sidebar_collapsed=true; _fbp=fb.1.15** ommited for security **88; experimentation_subject_id=IjJkMjVlMTQxLWNlMGUtNDAyNi04ZDg4LTQ2NjZjYTI3ZTE4ZiI%3D--ca69df800971e816e7b96d77ffa69617e626d01c; diff_view=parallel; frequently_used_emojis=thumbsup; remember_user_token=W1** ommited for security **8e; _gid=GA1.2.1192407613.1574728959; _biz_nA=6; _biz_pendingA=%5B%5D; _gitlab_session=39** ommited for security **01; _sp_ses.6b85=*; _sp_id.6b** ommited for security **76

{"issue":{"subscribed":true,"labels":[{"id":1418866,"title":"Development","color":"#5CB85C","description":"","textColor":"#FFFFFF","type":"GroupLabel","priority":null}],"assignees":[],"selected":false,"position":null,"isFetching":{"subscriptions":true},"isLoading":{},"title":"Set income to null fails before validation","project_id":270958}}
HTTP/1.1 422 Unprocessable Entity
Server: nginx
Date: Tue, 26 Nov 2019 22:12:15 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 2936
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Pragma: no-cache
X-Request-Id: Fl2jVbDs2k6
X-Runtime: 0.021759
GitLab-LB: fe-17-lb-gprd
GitLab-SV: web-27-sv-gprd

<!DOCTYPE html>
<html>
<head>
  <meta content="width=device-width, initial-scale=1, maximum-scale=1" name="viewport">
  <title>The change you requested was rejected (422)</title>
  <style>
    body {
      color: #666;
      text-align: center;
      font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;
      margin: auto;
      font-size: 14px;
    }

    h1 {
      font-size: 56px;
      line-height: 100px;
      font-weight: 400;
      color: #456;
    }

    h2 {
      font-size: 24px;
      color: #666;
      line-height: 1.5em;
    }

    h3 {
      color: #456;
      font-size: 20px;
      font-weight: 400;
      line-height: 28px;
    }

    hr {
      max-width: 800px;
      margin: 18px auto;
      border: 0;
      border-top: 1px solid #EEE;
      border-bottom: 1px solid white;
    }

    img {
      max-width: 40vw;
      display: block;
      margin: 40px auto;
    }

    a {
      line-height: 100px;
      font-weight: 400;
      color: #4A8BEE;
      font-size: 18px;
      text-decoration: none;
    }

    .container {
      margin: auto 20px;
    }

    .go-back {
      display: none;
    }

  </style>
</head>

<body>
  <a href="/">
    <img src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMjEwIiBoZWlnaHQ9IjIxMCIgdmlld0JveD0iMCAwIDIxMCAyMTAiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CiAgPHBhdGggZD0iTTEwNS4wNjE0IDIwMy42NTVsMzguNjQtMTE4LjkyMWgtNzcuMjhsMzguNjQgMTE4LjkyMXoiIGZpbGw9IiNlMjQzMjkiLz4KICA8cGF0aCBkPSJNMTA1LjA2MTQgMjAzLjY1NDhsLTM4LjY0LTExOC45MjFoLTU0LjE1M2w5Mi43OTMgMTE4LjkyMXoiIGZpbGw9IiNmYzZkMjYiLz4KICA8cGF0aCBkPSJNMTIuMjY4NSA4NC43MzQxbC0xMS43NDIgMzYuMTM5Yy0xLjA3MSAzLjI5Ni4xMDIgNi45MDcgMi45MDYgOC45NDRsMTAxLjYyOSA3My44MzgtOTIuNzkzLTExOC45MjF6IiBmaWxsPSIjZmNhMzI2Ii8+CiAgPHBhdGggZD0iTTEyLjI2ODUgODQuNzM0Mmg1NC4xNTNsLTIzLjI3My03MS42MjVjLTEuMTk3LTMuNjg2LTYuNDExLTMuNjg1LTcuNjA4IDBsLTIzLjI3MiA3MS42MjV6IiBmaWxsPSIjZTI0MzI5Ii8+CiAgPHBhdGggZD0iTTEwNS4wNjE0IDIwMy42NTQ4bDM4LjY0LTExOC45MjFoNTQuMTUzbC05Mi43OTMgMTE4LjkyMXoiIGZpbGw9IiNmYzZkMjYiLz4KICA8cGF0aCBkPSJNMTk3Ljg1NDQgODQuNzM0MWwxMS43NDIgMzYuMTM5YzEuMDcxIDMuMjk2LS4xMDIgNi45MDctMi45MDYgOC45NDRsLTEwMS42MjkgNzMuODM4IDkyLjc5My0xMTguOTIxeiIgZmlsbD0iI2ZjYTMyNiIvPgogIDxwYXRoIGQ9Ik0xOTcuODU0NCA4NC43MzQyaC01NC4xNTNsMjMuMjczLTcxLjYyNWMxLjE5Ny0zLjY4NiA2LjQxMS0zLjY4NSA3LjYwOCAwbDIzLjI3MiA3MS42MjV6IiBmaWxsPSIjZTI0MzI5Ii8+Cjwvc3ZnPgo="
       alt="GitLab Logo" />
  </a>
  <h1>
    422
  </h1>
  <div class="container">
    <h3>The change you requested was rejected.</h3>
    <hr />
    <p>Make sure you have access to the thing you tried to change.</p>
    <p>Please contact your GitLab administrator if you think this is a mistake.</p>
    <a href="javascript:history.back()" class="js-go-back go-back">Go back</a>
  </div>
  <script>
    (function () {
      var goBack = document.querySelector('.js-go-back');

      if (history.length > 1) {
        goBack.style.display = 'inline';
      }
    })();

  </script>
</body>
</html>

Output of checks

This bug happens on GitLab.com 2019-11-27

It has been happening for at least 6 months.

Possible fixes