--- a/mod_http_admin_api/mod_http_admin_api.lua	Thu Dec 07 15:43:16 2023 +0000
+++ b/mod_http_admin_api/mod_http_admin_api.lua	Thu Dec 07 15:43:47 2023 +0000
@@ -477,6 +477,9 @@
 end
 
 function update_user(event, username)
+	if not username then
+		return 400;
+	end
 
 	local request = event.request;
 	if request.headers.content_type ~= json_content_type