JS obtient les paramètres d'URL, JS envoie la méthode de requête POST au format json

<script type="text/javascript">

function US() {
var name, value;
var str = location.href;
var num = str.indexOf("?");
str = str.substr(num + 1);
var arr = str.split("&");
for (var i = 0; i < arr.length; i++) {
num = arr[i].indexOf("=");
if (num > 0) {
name = arr[i].substring(0, num);
value = arr[i].substr(num + 1);
this[name] = value;
}
}
}

var us = new US();
var xhr = new XMLHttpRequest();
xhr.open("POST", "/searchguard/api/v1/auth/login", true);
xhr.setRequestHeader("Content-type", "application/json");
xhr.setRequestHeader("kbn-version", "5.3.0");
xhr.onreadystatechange = function() {
if (xhr.readyState == 4) {
if (xhr.status == 200) {
window.location.href = us.nextUrl;
}
}
};
xhr.send(JSON.stringify({
"username" : us.u,
"password" : us.p
}));
</script>