diff --git a/openstack_dashboard/exceptions.py b/openstack_dashboard/exceptions.py
index 949a0ea589..b7591e1195 100644
--- a/openstack_dashboard/exceptions.py
+++ b/openstack_dashboard/exceptions.py
@@ -30,16 +30,11 @@ from troveclient import exceptions as troveclient
 
 UNAUTHORIZED = (
     keystoneclient.Unauthorized,
-    keystoneclient.Forbidden,
     cinderclient.Unauthorized,
-    cinderclient.Forbidden,
     novaclient.Unauthorized,
-    novaclient.Forbidden,
     glanceclient.Unauthorized,
     neutronclient.Unauthorized,
-    neutronclient.Forbidden,
     heatclient.HTTPUnauthorized,
-    heatclient.HTTPForbidden,
     troveclient.Unauthorized,
 )
 
@@ -61,19 +56,24 @@ RECOVERABLE = (
     keystoneclient.ClientException,
     # AuthorizationFailure is raised when Keystone is "unavailable".
     keystoneclient.AuthorizationFailure,
+    keystoneclient.Forbidden,
     cinderclient.ClientException,
     cinderclient.ConnectionError,
+    cinderclient.Forbidden,
     novaclient.ClientException,
+    novaclient.Forbidden,
     glanceclient.ClientException,
     # NOTE(amotoki): Neutron exceptions other than the first one
     # are recoverable in many cases (e.g., NetworkInUse is not
     # raised once VMs which use the network are terminated).
+    neutronclient.Forbidden,
     neutronclient.NeutronClientException,
     neutronclient.NetworkInUseClient,
     neutronclient.PortInUseClient,
     neutronclient.AlreadyAttachedClient,
     neutronclient.StateInvalidClient,
     swiftclient.ClientException,
+    heatclient.HTTPForbidden,
     heatclient.HTTPException,
     troveclient.ClientException
 )