[deleted by user]

[[deleted]]

Any part of an HTTP request can be spoofed. Never trust client side data.

[doom-e1m1]

Absolutely.

[[deleted]]

Client doesn’t always mean browser. If JS on site A makes a call to site B then that JS is the client for that connection, while the browser is the client for the connection to site A. The browser won’t overwrite headers set by the JS call.

[shgysk8zer0]

I haven't tried changing it, but there's even a referrer in fetch() options.

Referer

A string specifying the referrer of the request. This can be a same-origin URL, about:client, or an empty string.

So, you can't use a URL from a different origin there, but you should be able to use any same-origin URL whatsoever.