Thanks for working on this one. It's definitely a feature (so targetting master is a good idea).

My pleasure.

I don't think we have to add this to the UsernamePasswordJsonAuthenticationListener (those are part of a system that will be removed in Symfony 6). If you can, I think it's also a good idea to add a test for this new feature.

I will add a test. Takes some time^^

During writing the test i saw some other error messages like "Invalid username." (JsonLoginAuthenticator.php#L167).
Am i blind or is there no translation for it?

What do you think about the other error messages. Should they also translated see "Invalid JSON." or "The key "username" must be provided."

i figure we can re-use a bunch of translations from the validator domain.

no wait, i dont think http exceptions need to be translated at all. Usually they are caught by an ExceptionListener exposing the http status text in prod (while preserving the original message in dev).

In this case im fine with only translating the responses generated here 👍

Please note that the $message constructor is a non-user safe string and the messageKey is almost always hardcoded in the exception class. And this message key does exists:

@malteschlueter looks like the PR already needs a rebase 🙈

Thank you @malteschlueter.

Thanks for merging @fabpot. It was a little bit too fast^^
I missed to add some tests. I've done it here #38044 now. :)