protected HttpAction handleInvalidCredentials(final CallContext ctx, final String username, String message, String errorMessage) {
        val webContext = ctx.webContext();

        // it's an AJAX request -> unauthorized (instead of a redirection)
        if (getAjaxRequestResolver().isAjax(ctx)) {
            logger.info("AJAX request detected -> returning 401");
            return HttpActionHelper.buildUnauthenticatedAction(webContext);
        } else {
            var redirectionUrl = addParameter(this.loginUrl, this.usernameParameter, username);
            redirectionUrl = addParameter(redirectionUrl, ERROR_PARAMETER, errorMessage);
            logger.debug("redirectionUrl: {}", redirectionUrl);
            return HttpActionHelper.buildRedirectUrlAction(webContext, redirectionUrl);
        }
    }
<p>handleInvalidCredentials.</p>

@param ctx a {@link CallContext} object
@param username a {@link String} object
@param message a {@link String} object
@param errorMessage a {@link String} object
@return a {@link HttpAction} object
pac4j-http/src/main/java/org/pac4j/http/client/indirect/FormClient.java