glanceapp/glance · error

authentication request returned status %s with message '%s'

Error message

authentication request returned status %s with message '%s'

What it means

Returned by fetchPiholeSessionID when the auth response parsed as JSON but response.StatusCode != 200. The server explicitly rejected authentication; the message embeds the HTTP status line and the server-provided session.message (Pi-hole v6 reports reasons like 'password incorrect' there).

Source

Thrown at internal/glance/widget-dns-stats.go:650

	body, err := io.ReadAll(response.Body)
	if err != nil {
		return "", fmt.Errorf("reading authentication response: %v", err)
	}

	var jsonResponse struct {
		Session struct {
			SID     string `json:"sid"`
			Message string `json:"message"`
		} `json:"session"`
	}

	if err := json.Unmarshal(body, &jsonResponse); err != nil {
		return "", fmt.Errorf("parsing authentication response: %v", err)
	}

	if response.StatusCode != http.StatusOK {
		return "", fmt.Errorf(
			"authentication request returned status %s with message '%s'",
			response.Status, jsonResponse.Session.Message,
		)
	}

	if jsonResponse.Session.SID == "" {
		return "", fmt.Errorf(
			"authentication response returned empty session ID, status code %d, message '%s'",
			response.StatusCode, jsonResponse.Session.Message,
		)
	}

	return jsonResponse.Session.SID, nil
}

func checkPiholeSessionIDIsValid(instanceURL string, client *http.Client, sessionID string) (bool, error) {
	request, err := http.NewRequest("GET", instanceURL+"/api/auth", nil)
	if err != nil {

View on GitHub (pinned to 91324e8de7)

Solutions

1. Read the embedded session.message — it states the server-side reason.
2. Re-enter the exact web UI password, quoted in YAML: password: "p@$$word".
3. Verify by logging into the Pi-hole web UI with the same credential.
4. If locked out from failed attempts, wait or clear the lockout on the Pi-hole side.

Example fix

# before
password: mypa$$:word

# after
password: "mypa$$:word"

// verify credentials out-of-band before configuring the widget
// curl -X POST http://pihole/api/auth -H 'Content-Type: application/json' \
//   -d '{"password":"<cfg password>"}'  => expect 200 + session.sid

if err != nil && strings.Contains(err.Error(), "authentication request returned status") {
    // server rejected the credential — surface the embedded session.message
    return fmt.Errorf("pihole rejected credentials: %v", err)
}

When it happens

Trigger: Wrong password in the widget config (typically 401 Unauthorized); Pi-hole blocking due to too many failed attempts; FTL database locked or password not set server-side while one is sent.

Common situations: Password rotated in Pi-hole but not in glance config; password mangled by YAML (unquoted special chars like $, #, :); spaces copied along with the password.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• fetching session ID: %v
• renewing session ID: %v
• authentication response returned empty session ID, status co
• checking session ID: %v
• fetching stats: %v

AI-assisted analysis of glanceapp/glance@91324e8de7 (2026-08-15). Data as JSON: /api/errors/2f8bb85f36f5ab6a. Report an issue: GitHub.