config/src/main/java/org/springframework/security/config/http/CsrfBeanDefinitionParser.java
private BeanMetadataElement createAccessDeniedHandler(
			BeanDefinition invalidSessionStrategy,
			BeanMetadataElement defaultDeniedHandler) {
		if (invalidSessionStrategy == null) {
			return defaultDeniedHandler;
		}
		ManagedMap<Class<? extends AccessDeniedException>, BeanDefinition> handlers = new ManagedMap<Class<? extends AccessDeniedException>, BeanDefinition>();
		BeanDefinitionBuilder invalidSessionHandlerBldr = BeanDefinitionBuilder
				.rootBeanDefinition(InvalidSessionAccessDeniedHandler.class);
		invalidSessionHandlerBldr.addConstructorArgValue(invalidSessionStrategy);
		handlers.put(MissingCsrfTokenException.class,
				invalidSessionHandlerBldr.getBeanDefinition());

		BeanDefinitionBuilder deniedBldr = BeanDefinitionBuilder
				.rootBeanDefinition(DelegatingAccessDeniedHandler.class);
		deniedBldr.addConstructorArgValue(handlers);
		deniedBldr.addConstructorArgValue(defaultDeniedHandler);

		return deniedBldr.getBeanDefinition();
	}
private BeanMetadataElement createAccessDeniedHandler(
			BeanDefinition invalidSessionStrategy,
			BeanMetadataElement defaultDeniedHandler) {
		if (invalidSessionStrategy == null) {
			return defaultDeniedHandler;
		}
		ManagedMap<Class<? extends AccessDeniedException>, BeanDefinition> handlers = new ManagedMap<Class<? extends AccessDeniedException>, BeanDefinition>();
		BeanDefinitionBuilder invalidSessionHandlerBldr = BeanDefinitionBuilder
				.rootBeanDefinition(InvalidSessionAccessDeniedHandler.class);
		invalidSessionHandlerBldr.addConstructorArgValue(invalidSessionStrategy);
		handlers.put(MissingCsrfTokenException.class,
				invalidSessionHandlerBldr.getBeanDefinition());

		BeanDefinitionBuilder deniedBldr = BeanDefinitionBuilder
				.rootBeanDefinition(DelegatingAccessDeniedHandler.class);
		deniedBldr.addConstructorArgValue(handlers);
		deniedBldr.addConstructorArgValue(defaultDeniedHandler);

		return deniedBldr.getBeanDefinition();
	}
private BeanMetadataElement createAccessDeniedHandler ( BeanDefinition invalidSessionStrategy , BeanMetadataElement defaultDeniedHandler ) { if ( invalidSessionStrategy == null ) { return defaultDeniedHandler ; } ManagedMap < Class < ? extends AccessDeniedException > , BeanDefinition > handlers = new ManagedMap < Class < ? extends AccessDeniedException > , BeanDefinition > ( ) ; BeanDefinitionBuilder invalidSessionHandlerBldr = BeanDefinitionBuilder . rootBeanDefinition ( InvalidSessionAccessDeniedHandler . class ) ; invalidSessionHandlerBldr . addConstructorArgValue ( invalidSessionStrategy ) ; handlers . put ( MissingCsrfTokenException . class , invalidSessionHandlerBldr . getBeanDefinition ( ) ) ; BeanDefinitionBuilder deniedBldr = BeanDefinitionBuilder . rootBeanDefinition ( DelegatingAccessDeniedHandler . class ) ; deniedBldr . addConstructorArgValue ( handlers ) ; deniedBldr . addConstructorArgValue ( defaultDeniedHandler ) ; return deniedBldr . getBeanDefinition ( ) ; }
Creates the {@link AccessDeniedHandler} from the result of
{@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)} and
{@link #getInvalidSessionStrategy(HttpSecurityBuilder)}. If
{@link #getInvalidSessionStrategy(HttpSecurityBuilder)} is non-null, then a
{@link DelegatingAccessDeniedHandler} is used in combination with
{@link InvalidSessionAccessDeniedHandler} and the
{@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)}. Otherwise, only
{@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)} is used.

@param invalidSessionStrategy the {@link InvalidSessionStrategy} to use
@param defaultDeniedHandler the {@link AccessDeniedHandler} to use

@return the {@link BeanMetadataElement} that is the {@link AccessDeniedHandler} to
populate on the {@link CsrfFilter}
Creates the { @link AccessDeniedHandler } from the result of { @link #getDefaultAccessDeniedHandler ( HttpSecurityBuilder ) } and { @link #getInvalidSessionStrategy ( HttpSecurityBuilder ) } . If { @link #getInvalidSessionStrategy ( HttpSecurityBuilder ) } is non - null then a { @link DelegatingAccessDeniedHandler } is used in combination with { @link InvalidSessionAccessDeniedHandler } and the { @link #getDefaultAccessDeniedHandler ( HttpSecurityBuilder ) } . Otherwise only { @link #getDefaultAccessDeniedHandler ( HttpSecurityBuilder ) } is used .