Referrer is also a client thing. Referrer based hotlink protection implicitly trusts the visitors' UAs. Same for Origin; it just offloads the actual check to th

Referrer is also a client thing. Referrer based hotlink protection implicitly trusts the visitors' UAs. Same for Origin; it just offloads the actual check to the visitor. No big difference. HTTP Auth, on the other hand, is actual password protection which cannot be spoofed by a malicious client. Very different from robots.txt.