<!-- Do NOT report Security Vulnerabilities here. Please use https://github.com/spring-projects/spring-security/security/policy --> **Describe the bug** `CsrfBeanDefinitionParser` does not apply the value of `request-handler-ref` to the bean definition of `CsrfAuthenticationStrategy`. **Note:** By contrast, `CsrfConfigurer` does apply the configured `CsrfTokenRequestHandler` to the default `CsrfAuthenticationStrategy`. **Expected behavior** `CsrfBeanDefinitionParser` applies the value of `request-handler-ref` to the bean definition of `CsrfAuthenticationStrategy`.