We could allow configuring the following parameters in the captive_portal_login YAML part:

result_param_name: get parameter which if present indicates the result of authentication, can default to res
reason_failed_value: (defaults to failed) if the value of the result GET param matches this value, we can consider the authentication as failed
failure_message_param_name: get parameter which contains the reason for the failure, can default to reply

This should happen in the login component.
If an auth failure is detected, we can simply use postMessage to communicate the failure and the failure reason to the parent frame as described here: https://github.com/openwisp/openwisp-wifi-login-pages#handling-captive-portal--radius-errors.

We should also update that README section to indicate that for captive portals like coova chilli which simply redirect to the login page with some GET parameters in the querystring (instead of showing a dedicated failure page) this method can be used.

This can be solved with the following extra JS file loaded for the whole application:

function _getParam(name){
   if(name=(new RegExp("[?&]"+encodeURIComponent(name)+"=([^&]*)")).exec(location.search))
      return decodeURIComponent(name[1]);
}

var res = _getParam("res"),
    reply = _getParam("reply");

if (res === "failed" && reply) {
  window.parent.postMessage(
    {type: "authError", message: reply},
    "https://<HOSTNAME>",
  );
}

It's good enough for me now.