Only can access url in the whitelist