headers can be specified and implement whitelist