nicolargo/glances · warning · HTTPException

Invalid JSON body

Error message

Invalid JSON body

What it means

/api/4/token expects a JSON body; if request.json() raises (malformed JSON, wrong Content-Type handling, empty body), Glances returns 400 'Invalid JSON body'. It's a request-shape validation error, not an auth failure.

Source

Thrown at glances/outputs/glances_restful_api.py:827

        # Check if JWT is available
        if self._jwt_handler is None or not self._jwt_handler.is_available:
            raise HTTPException(
                status.HTTP_501_NOT_IMPLEMENTED,
                "JWT authentication is not available. Install python-jose or check configuration.",
            )

        # Check if password authentication is enabled
        if self._password is None:
            raise HTTPException(
                status.HTTP_501_NOT_IMPLEMENTED,
                "Password authentication is not enabled. Start Glances with --password option.",
            )

        # Parse request body
        try:
            body = await request.json()
        except Exception:
            raise HTTPException(status.HTTP_400_BAD_REQUEST, "Invalid JSON body")

        username = body.get('username')
        password = body.get('password')

        if not username or not password:
            raise HTTPException(
                status.HTTP_400_BAD_REQUEST,
                "Missing username or password in request body",
            )

        # Validate credentials
        if username != self.args.username:
            raise HTTPException(
                status.HTTP_401_UNAUTHORIZED,
                "Incorrect authentication",
                {"WWW-Authenticate": "Bearer"},
            )

View on GitHub (pinned to a240d8dfb3)

Solutions

1. Send a valid JSON body with the JSON content type: curl -H 'Content-Type: application/json' -d '{"username":"u","password":"p"}'.
2. Validate your payload with a JSON linter/jq before sending.
3. Check that no proxy or middleware rewrites the body.

Example fix

# before
curl -X POST http://host:61208/api/4/token -d 'username=u&password=p'
# 400 Invalid JSON body

# after
curl -X POST http://host:61208/api/4/token -H 'Content-Type: application/json' -d '{"username":"u","password":"p"}'

import json
json.dumps({'username': user, 'password': pwd})  # validate payload before sending
requests.post(url, json=payload)  # json= sets Content-Type automatically

r = requests.post(url, json=payload)
if r.status_code == 400 and 'Invalid JSON' in r.text:
    payload = json.dumps(payload)  # re-serialize and retry

When it happens

Trigger: POSTing form-encoded data without JSON headers, sending truncated JSON, or an empty body; curl -d '{bad json'.

Common situations: Clients sending application/x-www-form-urlencoded (the OAuth-style default in many HTTP tools); proxies stripping bodies; copy-paste shell quoting mistakes breaking the JSON.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Missing username or password in request body
• Unknown plugin {plugin} (available plugins: {self.plugins_li
• Unknown configuration item {section}
• Unknown argument item {item}
• JWT authentication is not available

AI-assisted analysis of nicolargo/glances@a240d8dfb3 (2026-08-27). Data as JSON: /api/errors/4370ffd92eff7e53. Report an issue: GitHub.