config/src/main/java/org/springframework/security/config/annotation/web/configurers/CsrfConfigurer.java
private AccessDeniedHandler createAccessDeniedHandler(H http) {
		InvalidSessionStrategy invalidSessionStrategy = getInvalidSessionStrategy(http);
		AccessDeniedHandler defaultAccessDeniedHandler = getDefaultAccessDeniedHandler(
				http);
		if (invalidSessionStrategy == null) {
			return defaultAccessDeniedHandler;
		}

		InvalidSessionAccessDeniedHandler invalidSessionDeniedHandler = new InvalidSessionAccessDeniedHandler(
				invalidSessionStrategy);
		LinkedHashMap<Class<? extends AccessDeniedException>, AccessDeniedHandler> handlers = new LinkedHashMap<Class<? extends AccessDeniedException>, AccessDeniedHandler>();
		handlers.put(MissingCsrfTokenException.class, invalidSessionDeniedHandler);
		return new DelegatingAccessDeniedHandler(handlers, defaultAccessDeniedHandler);
	}
private AccessDeniedHandler createAccessDeniedHandler(H http) {
		InvalidSessionStrategy invalidSessionStrategy = getInvalidSessionStrategy(http);
		AccessDeniedHandler defaultAccessDeniedHandler = getDefaultAccessDeniedHandler(
				http);
		if (invalidSessionStrategy == null) {
			return defaultAccessDeniedHandler;
		}

		InvalidSessionAccessDeniedHandler invalidSessionDeniedHandler = new InvalidSessionAccessDeniedHandler(
				invalidSessionStrategy);
		LinkedHashMap<Class<? extends AccessDeniedException>, AccessDeniedHandler> handlers = new LinkedHashMap<Class<? extends AccessDeniedException>, AccessDeniedHandler>();
		handlers.put(MissingCsrfTokenException.class, invalidSessionDeniedHandler);
		return new DelegatingAccessDeniedHandler(handlers, defaultAccessDeniedHandler);
	}
private AccessDeniedHandler createAccessDeniedHandler ( H http ) { InvalidSessionStrategy invalidSessionStrategy = getInvalidSessionStrategy ( http ) ; AccessDeniedHandler defaultAccessDeniedHandler = getDefaultAccessDeniedHandler ( http ) ; if ( invalidSessionStrategy == null ) { return defaultAccessDeniedHandler ; } InvalidSessionAccessDeniedHandler invalidSessionDeniedHandler = new InvalidSessionAccessDeniedHandler ( invalidSessionStrategy ) ; LinkedHashMap < Class < ? extends AccessDeniedException > , AccessDeniedHandler > handlers = new LinkedHashMap < Class < ? extends AccessDeniedException > , AccessDeniedHandler > ( ) ; handlers . put ( MissingCsrfTokenException . class , invalidSessionDeniedHandler ) ; return new DelegatingAccessDeniedHandler ( handlers , defaultAccessDeniedHandler ) ; }
Creates the {@link AccessDeniedHandler} from the result of
{@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)} and
{@link #getInvalidSessionStrategy(HttpSecurityBuilder)}. If
{@link #getInvalidSessionStrategy(HttpSecurityBuilder)} is non-null, then a
{@link DelegatingAccessDeniedHandler} is used in combination with
{@link InvalidSessionAccessDeniedHandler} and the
{@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)}. Otherwise, only
{@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)} is used.

@param http the {@link HttpSecurityBuilder}
@return the {@link AccessDeniedHandler}
Creates the { @link AccessDeniedHandler } from the result of { @link #getDefaultAccessDeniedHandler ( HttpSecurityBuilder ) } and { @link #getInvalidSessionStrategy ( HttpSecurityBuilder ) } . If { @link #getInvalidSessionStrategy ( HttpSecurityBuilder ) } is non - null then a { @link DelegatingAccessDeniedHandler } is used in combination with { @link InvalidSessionAccessDeniedHandler } and the { @link #getDefaultAccessDeniedHandler ( HttpSecurityBuilder ) } . Otherwise only { @link #getDefaultAccessDeniedHandler ( HttpSecurityBuilder ) } is used .