anchor.diff:  [source,java]
   ----
   public class WebSecurity {
  -    public boolean check(Authentication authentication, HttpServletRequest request) {
  -        ...
  -    }
  +		public boolean check(Authentication authentication, HttpServletRequest request) {
  +				...
  +		}
   }
   ----
   
  
positive.code: public class WebSecurityConfig extends
  WebSecurityConfigurerAdapter {
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
  	http
  	// ...
  	.headers()
  		.frameOptions()
  			.sameOrigin()
  			.and()
  		.hsts().disable();
  }
  }
  ----
  
  
negative.code: [source,java]
  ----
  http
  		.authorizeUrls()
  				.antMatchers("/user/{userId}/**").access("@webSecurity.checkUserId(authentication,userId)")
  				...
  ----
  
  In both configurations URLs that match would pass in the path variable (and convert it) into checkUserId method.
  