Whitelisting not working as expected