Spoofing Referer, Origin, User-Agent and other headers

Requests are sent from Node's HTTP stack, not a browser, so none of the browser's "forbidden header" rules apply. Whatever you put in the Headers tab is sent exactly as written, including:

• Referer, Origin and User-Agent
• Host (useful for virtual hosts)
• Cookie (overrides the cookie jar for that request; after a redirect the jar's cookies are sent, and a custom Host is dropped)
• X-Forwarded-For and other Sec-* headers

The header-name field autocompletes common headers. A custom Referer is kept when redirects are followed.

Some of these are set automatically if you don't set them (User-Agent, Accept, Accept-Encoding, Cache-Control unless Send no-cache header is off, Host, Content-Type, Content-Length), as are the auth header and the cookie jar's Cookie. Your own value always wins; Show auto-generated in the Headers tab lists the first group. The default User-Agent can be changed in Settings.