Typically only with whitelisted URLs/hosts.