[Security] Custom Authenticator: What does "validate no parameter is empty" mean? about symfony-docs HOT 2 OPEN

Hi! I agree with (3), this seems an irrelevant to mention in this particular example. Let's remove the text and leave just // ....

As for your other 2 questions: I would say it's good to validate user input related to authentication explicitly if it confirms the rules of your application, rather than relying on "implementation details" of the Symfony framework.
This is also an approach we use in the build-in Symfony authenticators (we recently added it for form login: symfony/symfony#53851).

Throwing an authentication exception is the best solution, this will give the validation the same handling as other authentication error messages like "bad credentials" (i.e. call the onAuthenticationFailure() method of the current authenticator, which then has some way to return the error to the client).

from symfony-docs.

Sorry, I wasn't aware that an exception in this context isn't really thrown, but caught by the next method. So raising an exception is indeed the way to go!

So I think this code snippet should be expanded to something like:

if ('' === $username || '' === $password) {
    throw new WhateverException();
}

But where to put it?
This page is missing a full example of a form login. This is due to the fact that there cannot be a full example for every possible setup. But: When introducing the sub-headings (as I suggested in #19813 (comment) ), the new section under authenticate() would be the perfect place!

So in case you're already losing overview of what I have in mind ;-)
Should I create one big PR for everything on this page, or try to do it in smaller steps?

from symfony-docs.