nicolargo/glances · warning · HTTPException

Missing username or password in request body

Error message

Missing username or password in request body

What it means

After successfully parsing the JSON body of /api/4/token, if either 'username' or 'password' is missing or falsy, Glances returns 400 'Missing username or password in request body'. Both keys are required in the JSON object.

Solutions

1. Include both non-empty fields: {"username": "...", "password": "..."}.
2. Check exact key spelling — no 'user', 'pwd', or nested objects.
3. Ensure client config doesn't substitute empty strings for unset credentials.

Example fix

# before
curl -X POST http://host:61208/api/4/token -H 'Content-Type: application/json' -d '{"username":"u"}'
# 400 Missing username or password

# after
curl -X POST http://host:61208/api/4/token -H 'Content-Type: application/json' -d '{"username":"u","password":"p"}'

payload = {'username': user, 'password': pwd}
assert payload['username'] and payload['password'], 'both fields required'

def is_valid_token_payload(body: dict) -> bool:
    return isinstance(body, dict) and bool(body.get('username')) and bool(body.get('password'))

When it happens

Trigger: POSTing {}, {'username':'u'} (no password), or keys with empty-string values; key typos like 'user'/'pass'.

Common situations: Clients adapting from other token APIs that use grant_type/password flow field names; scripts defaulting missing config to empty strings.

Related errors

• Invalid JSON body
• Unknown argument item
• Unknown configuration item
• Unknown plugin (available plugins: )
• Cannot get args item

AI-assisted analysis of nicolargo/glances@a240d8dfb3 (2026-08-27). Data as JSON: /api/errors/496edbb77a4eef34. Report an issue: GitHub.

Appendix: source

Thrown at glances/outputs/glances_restful_api.py:833

        # Check if password authentication is enabled
        if self._password is None:
            raise HTTPException(
                status.HTTP_501_NOT_IMPLEMENTED,
                "Password authentication is not enabled. Start Glances with --password option.",
            )

        # Parse request body
        try:
            body = await request.json()
        except Exception:
            raise HTTPException(status.HTTP_400_BAD_REQUEST, "Invalid JSON body")

        username = body.get('username')
        password = body.get('password')

        if not username or not password:
            raise HTTPException(
                status.HTTP_400_BAD_REQUEST,
                "Missing username or password in request body",
            )

        # Validate credentials
        if username != self.args.username:
            raise HTTPException(
                status.HTTP_401_UNAUTHORIZED,
                "Incorrect authentication",
                {"WWW-Authenticate": "Bearer"},
            )

        # Check password
        if not self._password.check_password(self.args.password, self._password.get_hash(password)):
            raise HTTPException(
                status.HTTP_401_UNAUTHORIZED,
                "Incorrect authentication",
                {"WWW-Authenticate": "Bearer"},

View on GitHub (pinned to a240d8dfb3)