Technically speaking, its possible to spoof both headers using an intercepting proxy but that's useless because we are doing it ourselves as an attacker.

When we send ajax request using JS from another domain with our spoofed referer and origin header it won't really be spoofed. Browser would send the legit header to the server.

My question is, why is it so that we can't spoof both this headers while sending cross domain requests?

Technically speaking, it is possible to spoof both headers using an intercepting proxy but that's useless because we are doing it ourselves as an attacker.

When we send an ajax request using JS from another domain with our spoofed referer and origin header it won't really be spoofed. The browser would still send the legit header to the server.

My question is, why is it so that we can't spoof both these headers while sending cross domain requests?