Latest revision: 2022-07-11.
This simple gist sheds a bit of light on CORS and indicating an HTTP request origin. Should be easy to trick the server by setting Origin
header, right? Not really.
CORS is a browser mechanism build around the forbidden Origin
request header. That means the browser/user agent is in charge of telling the server where the request originates from. Setting the header manually/with code has no effect.