code: public void processRequest(RequestContext context, RequestSecurityProcessorChain processorChain) throws Exception {
          Map<String, Expression> urlRestrictions = getUrlRestrictions();
  
          if (MapUtils.isNotEmpty(urlRestrictions)) {
              HttpServletRequest request = context.getRequest();
              String requestUrl = getRequestUrl(context.getRequest());
  
              logger.debug("Checking access restrictions for URL {}", requestUrl);
  
              for (Map.Entry<String, Expression> entry : urlRestrictions.entrySet()) {
                  String urlPattern = entry.getKey();
                  Expression expression = entry.getValue();
  
                  if (pathMatcher.match(urlPattern, requestUrl)) {
                      logger.debug("Checking restriction [{} => {}]", requestUrl, expression.getExpressionString());
  
                      if (isAccessAllowed(request, expression)) {
                          logger.debug("Restriction [{}' => {}] evaluated to true for user: access allowed", requestUrl,
                                       expression.getExpressionString());
  
                          break;
                      } else {
                          throw new AccessDeniedException("Restriction ['" + requestUrl + "' => " +
                                                          expression.getExpressionString() + "] evaluated to false " +
                                                          "for user: access denied");
                      }
                  }
              }
          }
  
          processorChain.processRequest(context);
      }
docs: Matches the request URL against the keys of the {@code restriction} map, which are ANT-style path patterns. If
  a key matches, the value is interpreted as a Spring EL expression, the expression is executed, and if it returns
  true, the processor chain is continued, if not an {@link AccessDeniedException} is thrown.
  
  @param context        the context which holds the current request and response
  @param processorChain the processor chain, used to call the next processor