nicolargo/glances · warning · HTTPException

Missing username or password in request body

Error message

Missing username or password in request body

What it means

After successfully parsing the JSON body of /api/4/token, if either 'username' or 'password' is missing or falsy, Glances returns 400 'Missing username or password in request body'. Both keys are required in the JSON object.

Source

Thrown at glances/outputs/glances_restful_api.py:833

        # Check if password authentication is enabled
        if self._password is None:
            raise HTTPException(
                status.HTTP_501_NOT_IMPLEMENTED,
                "Password authentication is not enabled. Start Glances with --password option.",
            )

        # Parse request body
        try:
            body = await request.json()
        except Exception:
            raise HTTPException(status.HTTP_400_BAD_REQUEST, "Invalid JSON body")

        username = body.get('username')
        password = body.get('password')

        if not username or not password:
            raise HTTPException(
                status.HTTP_400_BAD_REQUEST,
                "Missing username or password in request body",
            )

        # Validate credentials
        if username != self.args.username:
            raise HTTPException(
                status.HTTP_401_UNAUTHORIZED,
                "Incorrect authentication",
                {"WWW-Authenticate": "Bearer"},
            )

        # Check password
        if not self._password.check_password(self.args.password, self._password.get_hash(password)):
            raise HTTPException(
                status.HTTP_401_UNAUTHORIZED,
                "Incorrect authentication",
                {"WWW-Authenticate": "Bearer"},

View on GitHub (pinned to a240d8dfb3)

Solutions

1. Include both non-empty fields: {"username": "...", "password": "..."}.
2. Check exact key spelling — no 'user', 'pwd', or nested objects.
3. Ensure client config doesn't substitute empty strings for unset credentials.

Example fix

# before
curl -X POST http://host:61208/api/4/token -H 'Content-Type: application/json' -d '{"username":"u"}'
# 400 Missing username or password

# after
curl -X POST http://host:61208/api/4/token -H 'Content-Type: application/json' -d '{"username":"u","password":"p"}'

payload = {'username': user, 'password': pwd}
assert payload['username'] and payload['password'], 'both fields required'

def is_valid_token_payload(body: dict) -> bool:
    return isinstance(body, dict) and bool(body.get('username')) and bool(body.get('password'))

When it happens

Trigger: POSTing {}, {'username':'u'} (no password), or keys with empty-string values; key typos like 'user'/'pass'.

Common situations: Clients adapting from other token APIs that use grant_type/password flow field names; scripts defaulting missing config to empty strings.

Related errors

• Invalid JSON body
• Unknown plugin {plugin} (available plugins: {self.plugins_li
• Unknown configuration item {section}
• Unknown argument item {item}
• JWT authentication is not available

AI-assisted analysis of nicolargo/glances@a240d8dfb3 (2026-08-27). Data as JSON: /api/errors/496edbb77a4eef34. Report an issue: GitHub.