The server cannot know if an event is coming from a browser or not, and anyone can make it look like coming from a browser while making it from another program,

The server cannot know if an event is coming from a browser or not, and anyone can make it look like coming from a browser while making it from another program, although you can't do it inside a proper browser.