I GUESS SOME REQUEST HEADERS ARE MORE TRUSTWORTHY THAN OTHERS

Summary from the TLDR Web Dev newsletter

Forbidden request headers are HTTP headers that user agents (browsers) cannot modify. These headers, like fetch metadata request headers (sec-fetch-*), can reliably show if a request originates from a user navigating directly in the browser. Forbidden headers like "Host" cannot be overridden.