FormLogin to be configurable to take in username and password as json.

Expected Behavior

FormLogin should be configurable to take in username and password as a predefined json object.

Current Behavior

FormLogin currently only accepts requests with form parameters.

Context

Most people today that write front end application deal with json and not form parameters. Its very easy to send form parameters using javascript fetch, but most just dont do it. They usually want to send data using json, and in 99% of the cases they send it as:

{
    "username": "foobar",
    "password": "secret"
}

currently the only way to get spring security to handle this is to completely opt-out from form login, and instead write either a custom filter or a custom endpoint which has to create the security context manually. This leads to many confusing questions on stack overflow, faulty implementations, and general opinions on spring security being overly complex just to do something as simple as a json formatted login.

My proposal is that either formLogin should be, just like the oauth resource server part of spring security (that can be configured to either take an opague token or a jwt) configurable to take form login parameters or json login parameters.

Example:

formLogin(formLoginSpec::json)

Many also wish to return JWTs after login to establish a session (which im not a big fan of but that is my personal opinion) then they can leverage features in form login like AuthenticationSuccessHandlers to build their JWTs, which i find fits the spring security features better than many constructing custom filters etc.

Start by reviewing the existing formLogin configuration and authentication flow, including how AuthenticationSuccessHandlers are used. Define how a JSON object containing username and password would be accepted while preserving form-parameter support; done means both request styles authenticate through the standard form-login features.