title: Express.js - Requester domain/IP reliability
body: <p>I recently saw <a href="https://stackoverflow.com/questions/18498726/how-do-i-get-the-domain-originating-the-request-in-express-js">this</a> SO post about getting the domain of a request. I'm wondering if this information would be reliable (ie. can an attacker "fake" this info?). Specifically, the domain and request type (GET, POST, etc). The reason I ask is because I'm not sure if I can use this to secure my application's backend. I figured that I should only allow POST requests from my own domain.</p>