title: Can I "trust" request origin parameter?
body: <p>Let's assume my site is example.com. On my server I have script which must works only for white listed site. I have setuped this code which allow XHR requests only from my site.</p>
  
  <pre><code>header('Access-Control-Allow-Origin: https://www.example.com')
  </code></pre>
  
  <p>Now I'm wondering can someone change origin parameter and send fake AJAX requests from another sites ?
  So is origin parameter trusted or there is a ways to "override" origin parameter example from script or browser configuration or from some third part service ?</p>