config/src/main/java/org/springframework/security/config/http/CsrfBeanDefinitionParser.java
private BeanMetadataElement createAccessDeniedHandler(
			BeanDefinition invalidSessionStrategy,
			BeanMetadataElement defaultDeniedHandler) {
		if (invalidSessionStrategy == null) {
			return defaultDeniedHandler;
		}
		ManagedMap<Class<? extends AccessDeniedException>, BeanDefinition> handlers = new ManagedMap<Class<? extends AccessDeniedException>, BeanDefinition>();
		BeanDefinitionBuilder invalidSessionHandlerBldr = BeanDefinitionBuilder
				.rootBeanDefinition(InvalidSessionAccessDeniedHandler.class);
		invalidSessionHandlerBldr.addConstructorArgValue(invalidSessionStrategy);
		handlers.put(MissingCsrfTokenException.class,
				invalidSessionHandlerBldr.getBeanDefinition());

		BeanDefinitionBuilder deniedBldr = BeanDefinitionBuilder
				.rootBeanDefinition(DelegatingAccessDeniedHandler.class);
		deniedBldr.addConstructorArgValue(handlers);
		deniedBldr.addConstructorArgValue(defaultDeniedHandler);

		return deniedBldr.getBeanDefinition();
	}
private BeanMetadataElement createAccessDeniedHandler(
			BeanDefinition invalidSessionStrategy,
			BeanMetadataElement defaultDeniedHandler) {
		if (invalidSessionStrategy == null) {
			return defaultDeniedHandler;
		}
		ManagedMap<Class<? extends AccessDeniedException>, BeanDefinition> handlers = new ManagedMap<Class<? extends AccessDeniedException>, BeanDefinition>();
		BeanDefinitionBuilder invalidSessionHandlerBldr = BeanDefinitionBuilder
				.rootBeanDefinition(InvalidSessionAccessDeniedHandler.class);
		invalidSessionHandlerBldr.addConstructorArgValue(invalidSessionStrategy);
		handlers.put(MissingCsrfTokenException.class,
				invalidSessionHandlerBldr.getBeanDefinition());

		BeanDefinitionBuilder deniedBldr = BeanDefinitionBuilder
				.rootBeanDefinition(DelegatingAccessDeniedHandler.class);
		deniedBldr.addConstructorArgValue(handlers);
		deniedBldr.addConstructorArgValue(defaultDeniedHandler);

		return deniedBldr.getBeanDefinition();
	}
Creates the {@link AccessDeniedHandler} from the result of
{@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)} and
{@link #getInvalidSessionStrategy(HttpSecurityBuilder)}. If
{@link #getInvalidSessionStrategy(HttpSecurityBuilder)} is non-null, then a
{@link DelegatingAccessDeniedHandler} is used in combination with
{@link InvalidSessionAccessDeniedHandler} and the
{@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)}. Otherwise, only
{@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)} is used.

@param invalidSessionStrategy the {@link InvalidSessionStrategy} to use
@param defaultDeniedHandler the {@link AccessDeniedHandler} to use

@return the {@link BeanMetadataElement} that is the {@link AccessDeniedHandler} to
populate on the {@link CsrfFilter}