{"record":{"id":"496edbb77a4eef34","repo":"nicolargo/glances","slug":"missing-username-or-password-in-request-body","errorCode":null,"errorMessage":"Missing username or password in request body","messagePattern":"Missing username or password in request body","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"warning","filePath":"glances/outputs/glances_restful_api.py","lineNumber":833,"sourceCode":"\n        # Check if password authentication is enabled\n        if self._password is None:\n            raise HTTPException(\n                status.HTTP_501_NOT_IMPLEMENTED,\n                \"Password authentication is not enabled. Start Glances with --password option.\",\n            )\n\n        # Parse request body\n        try:\n            body = await request.json()\n        except Exception:\n            raise HTTPException(status.HTTP_400_BAD_REQUEST, \"Invalid JSON body\")\n\n        username = body.get('username')\n        password = body.get('password')\n\n        if not username or not password:\n            raise HTTPException(\n                status.HTTP_400_BAD_REQUEST,\n                \"Missing username or password in request body\",\n            )\n\n        # Validate credentials\n        if username != self.args.username:\n            raise HTTPException(\n                status.HTTP_401_UNAUTHORIZED,\n                \"Incorrect authentication\",\n                {\"WWW-Authenticate\": \"Bearer\"},\n            )\n\n        # Check password\n        if not self._password.check_password(self.args.password, self._password.get_hash(password)):\n            raise HTTPException(\n                status.HTTP_401_UNAUTHORIZED,\n                \"Incorrect authentication\",\n                {\"WWW-Authenticate\": \"Bearer\"},","sourceCodeStart":815,"sourceCodeEnd":851,"githubUrl":"https://github.com/nicolargo/glances/blob/a240d8dfb3105a38b5964357ec21768594b0e83e/glances/outputs/glances_restful_api.py#L815-L851","documentation":"After successfully parsing the JSON body of /api/4/token, if either 'username' or 'password' is missing or falsy, Glances returns 400 'Missing username or password in request body'. Both keys are required in the JSON object.","triggerScenarios":"POSTing {}, {'username':'u'} (no password), or keys with empty-string values; key typos like 'user'/'pass'.","commonSituations":"Clients adapting from other token APIs that use grant_type/password flow field names; scripts defaulting missing config to empty strings.","solutions":["Include both non-empty fields: {\"username\": \"...\", \"password\": \"...\"}.","Check exact key spelling — no 'user', 'pwd', or nested objects.","Ensure client config doesn't substitute empty strings for unset credentials."],"exampleFix":"# before\ncurl -X POST http://host:61208/api/4/token -H 'Content-Type: application/json' -d '{\"username\":\"u\"}'\n# 400 Missing username or password\n\n# after\ncurl -X POST http://host:61208/api/4/token -H 'Content-Type: application/json' -d '{\"username\":\"u\",\"password\":\"p\"}'","handlingStrategy":"validation","validationCode":"payload = {'username': user, 'password': pwd}\nassert payload['username'] and payload['password'], 'both fields required'","typeGuard":"def is_valid_token_payload(body: dict) -> bool:\n    return isinstance(body, dict) and bool(body.get('username')) and bool(body.get('password'))","tryCatchPattern":null,"preventionTips":["Always send both username and password, non-empty.","Check exact key names — 'username' and 'password', no aliases."],"tags":["rest-api","http-400","request-validation","token"],"backgroundTag":"missing-request-field","analyzedSha":"a240d8dfb3105a38b5964357ec21768594b0e83e","analyzedAt":"2026-08-27T19:15:19.178Z","schemaVersion":2},"datasetVersion":"2026-08-27T19:17:21.184Z"}