Shouldn't we remove the if below instead? I fail to see how $isPasswordValid could ever be false.

        if ($currentUser instanceof UserInterface) {
            if ($currentUser->getPassword() !== $user->getPassword()) {
                throw new BadCredentialsException('The credentials were changed from another session.');
            }
        } else {
            if ('' === ($givenPassword = $token->getCredentials())) {
                throw new BadCredentialsException('The given password cannot be empty.');
            }
            if (!$this->encoder->isPasswordValid($user->getPassword(), $givenPassword, $user->getSalt())) {
                throw new BadCredentialsException('The given password is invalid.');
            }
        }
        if ($isPasswordValid) {
                ...
        }

I think $isPasswordValid was undefined

That's right. But what I mean is that even if we initialise the variable now, it will never be false when the if ($isPasswordValid) statement is reached (because in those cases the code above would have already exited the method with an exception), right?

I agree with @xabbuh, we should just remove the if.

It seems that it was overlooked when making this change: https://github.com/Reyh/symfony-docs/commit/3fb163c0792f695e85bbdbe1dbdc138db58f8e5e#diff-0afb1ed1142b93956c79786c3b4c6550

Wait a second. This whole new code block is a bit insane :). I see it was added in #10100 to fix #4579.

Let's fix any logic needed here. But this article should be re-written to support Guard.

Do we know what we want the logic to look like exactly?

@Reyh thanks a lot for this contribution and for helping us improve the current code. Sadly this pull request "stalled" and there are merge conflicts, so I've opened #10448 to make the alternative fix proposed by @xabbuh. In any case, we hope to see more contributions from you in the future for Symfony Docs. Thanks a lot!