Closed
Description
In some cases DefaultAuthorizationCodeTokenResponseClient.getTokenResponse(OAuth2AuthorizationCodeGrantRequest) can return null. For example, when a redirect is returned the body is empty. This causes a NullPointerException in OidcAuthorizationCodeAuthenticationProvider.
If the response is invalid, I believe we should provide a meaningful error to users.