title: Can http_origin be spoofed?
body: <p>I host a javascript that site owners run on their website. My server is a LAMP stack.  I'm trying to secure the script for approved web sites. What are some ways to do this? I'm currently looking for <code>$_SERVER['HTTP_ORIGIN']</code> and <code>Access-Control-Allow-Origin</code> to <code>allow access</code>. Is this the most secure way to do this , can be spoofed? </p>
  
  <p>My javascript is to provide a service and needs to be secure. Think google analytics - the js that people put on their web site.</p>