Tweet · 19 Dec 2017, 12:04 UTC

Replying to @null and @borisschapira

Yes, client side, just like for HTTP. I figured you would whitelist yours.