diff --git a/chfs-ng/internal/api/server.go b/chfs-ng/internal/api/server.go
index 5d58f6a..4e0a6fe 100644
--- a/chfs-ng/internal/api/server.go
+++ b/chfs-ng/internal/api/server.go
@@ -109,6 +109,12 @@ func writeJSON(w http.ResponseWriter, v any) {
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	json.NewEncoder(w).Encode(v)
 }
+
+func writeJSONError(w http.ResponseWriter, status int, message string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(map[string]string{"error": message})
+}
 func qpath(r *http.Request) string {
 	return strings.Trim(strings.ReplaceAll(r.URL.Query().Get("filepath"), "\\", "/"), "/")
 }
@@ -263,9 +269,13 @@ func (s *Server) session(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	user, pwd := r.FormValue("user"), r.FormValue("pwd")
+	if user == "" && pwd == "" {
+		writeJSONError(w, http.StatusBadRequest, "invalid parameter")
+		return
+	}
 	a := s.Auth.Authenticate(user, pwd)
 	if a == nil {
-		http.Error(w, "invalid account", http.StatusUnauthorized)
+		writeJSONError(w, http.StatusNotFound, "user or password is wrong")
 		return
 	}
 	token := auth.NewToken()