It is absolutely the job of the server to determine the source and validity of a request. Web browsers, for better or for worse, fundamentally allow websites to

It is absolutely the job of the server to determine the source and validity of a request. Web browsers, for better or for worse, fundamentally allow websites to make requests to other sites. "Rogue" websites can "trick" users into requesting images, videos, music, javascript, stylesheets or trick users into making POST requests to your site. This is why tech like csrf tokens exist.