Is it possible to fake the Origin and Refer headers?

Question

HTTP headers

Is it possible?
For example, from specialized software like Postman.
Here, for example, I made a check on the NodeJS server side

if (!req.headers.origin || !req.headers.referer) {
    res.cookie('message', 'fuck you, hacker', {maxAge: 600000, httpOnly: true})
    res.send('fuck you, hacker')
    console.log('fuck you, hacker')
  }

But does it make sense if the title can be faked?

Answer 1

Of course, you can fake any headers in the web client.
But why?