…ponse on bad request format (ogizanagi)This PR was merged into the 3.3-dev branch.Discussion----------[Security] json auth listener should not produce a 500 response on bad request format| Q             | A| ------------- | ---| Branch?       | master| Bug fix?      | yes| New feature?  | no| BC breaks?    | no| Deprecations? | no| Tests pass?   | yes| Fixed tickets | N/A| License       | MIT| Doc PR        | N/ATo me, it looks wrong to simply throw a `BadCredentialsException` in the wild, which produces a 500 (unless an entrypoint handles it, which you probably don't have on a json login firewall). There isn't any server error, the client request originated the error due to a wrong format.Instead, the listener should give a chance to the failure handler to resolve it, and return a proper 4XX response. (BTW, the `UsernamePasswordFormAuthenticationListener` also throws a similar `BadCredentialsException` on a too long submitted username, which is caught and forwarded to the failure handler)Better diff:https://github.com/symfony/symfony/pull/22034/files?w=1BTW, should we have another exception type like `BadCredentialsFormatException` or whatever in order to distinct a proper `BadCredentialsException` from a format issue in a failure listener?Commits-------cb175a4 [Security] json auth listener should not produce a 500 response on bad request format

… (ogizanagi)This PR was merged into the 3.3-dev branch.Discussion----------[Security] Handle bad request format in json auth listener| Q             | A| ------------- | ---| Branch?       | master (3.3)| Bug fix?      | yesish| New feature?  | yes| BC breaks?    | no| Deprecations? | no| Tests pass?   | yes| Fixed tickets | N/A| License       | MIT| Doc PR        | N/AIn#22034, I wondered myself if we shouldn't throw a dedicated exception to handle bad formatted requests and give more inputs to the client by returning a 400 response with an explicit message.~~Here is a suggestion, introducing a new `BadRequestFormatException` and using it in `UsernamePasswordJsonAuthenticationListener` whenever there is no custom failure handler set (but someone using its own handler should be able to treat the failure properly too).~~As discussed with@chalasr , it seems better to directly throw a `BadRequestHttpException` as it's actually out of the whole security process. PR updated.Commits-------93a8cb9 [Security] Handle bad request format in json auth listener