title: How secure is HTTP_ORIGIN?
body: <p>I want to find out whether an incoming HTTP_REQUEST call from a third party website is coming from the list of domains that I defined.</p>
  
  <p>I know that HTTP_REFERER can be used to find out where the third party domain is, but it is not secure enough. People can spoof it or use Telnet to fake it.</p>
  
  <p>So, how about HTTP_ORIGIN? Is it sent from all browsers? Is it secure?</p>
  
  <p>Also, can people fake the REMOTE_ADDR in a HTTP_REQUEST call?</p>